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VOLUME  VI 
IN  THE  UNITED  STATES  ARMY 

UNITED  STATES 
VS. 

MANNING,   Bradley  E.,   PFC  COURT-MARTIAL 
U.S.  Army,   xxx— xx— 9504 

Headquarters  and  Headquarters  Company, 

U.S.   Army  Garrison, 

Joint  Base  Myer— Henderson  Hall, 

Fort  Myer,   VA  22211 

 / 


The  Hearing  in  the  above— entitled  matter  was 
held  on  Wednesday,   June  12,   2013,   at  9:30  a.m.,   at  Fort 
Meade,  Maryland,  before  the  Honorable  Colonel 
Denise  Lind,    Judge . 
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DISCLAIMER 

This  transcrip-t  was  made  by  a  court 
reporter  who  is  not  the  official  Government  reporter, 
was  not  permitted  to  be  in  the  actual  courtroom  where 
the  proceedings  took  place,  but  in  a  media  room 
listening  to  and  watching  live  audio/video  feed,  not 
permitted  to  make  an  audio  backup  recording  for 
editing  purposes,   and  not  having  the  ability  to 
control  the  proceedings  in  order  to  produce  an 
accurate  verbatim  transcript . 

This  unedited,  uncertified  draft 
transcript  may  contain  court  reporting  outlines  that 
are  not  translated,  notes  made  by  the  reporter  for 
editing  purposes,  misspelled  terms  and  names,  word 
combinations  that  do  not  make  sense,   and  missing 
testimony  or  colloquy  due  to  being  inaudible  to  the 
reporter . 
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PROCEEDING, 
THE  COURT:     Major  Fein,  please  account  for 

the  parties . 

MR.   FEIN:     Your  Honor,   all  parties  in  the 
court  when  the  court  last  recessed  are  again  present . 

THE  COURT:     Is  the  government  ready  to 

proceed? 

MR.  FEIN:     Yes,  ma'am. 

THE  COURT:     Are  there  any  issues  we  need  on 
address  before  we  proceed? 

MR.  FEIN:     No,  ma'am. 

MR .   COOMBS :     No ,   Your  Honor . 

THE  COURT:     All  right.  Proceed. 

MR.  MORROW:     The  government  recalls  Mr.  Mark 

Johnson . 

Mr.   Johnson,   I  just  want  to  remind  you  you're 
still  under  oath. 

THE  WITNESS:      Yes,  sir. 

Whereupon : 

MARK  JOHNSON, 
recalled  as  a  witness,  having  been  previously  duly 
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sworn  according  to  law,   testified  as  follows : 
DIRECT  EXAMINATION  BY  MR.  MORROW: 

Q.  Mr.   Johnson,   we  discussed  your  examination  of 

an  external  hard  disk  drive  earlier.     What  other  pieces 
of  evidence  did  you  examine  in  this  case? 

A.  We  examined  a  forensic  image  obtained  from  PFC 

Manning ' s  Mac  Book  Pro  computer  or  laptop . 

Q.  You  said  a  Mac  Book  Pro  laptop? 

A.  Mac  Book  Pro  laptop. 

THE  COURT:     A  Mac? 

THE  WITNESS:     A  Mac  Book  Pro,   Your  Honor. 
BY  MR.  MORROW: 

Q.  Who  makes  that,  a  Mac  Book  Pro? 

A.  Apple  Computer. 

Q.  And  what  exactly  did  you  examine? 

A.  I  examined  the  forensic  image  of  the  hard 

drive  obtained  from  that  laptop. 

Q.  And  before  beginning  your  examination,  what 

did  you  do  first? 

A.  Retrieved  the  evidence  from  our  evidence 

storage,  brought  it  to  my  work  station,  made  a  local 
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copy,   working  copy,  validated  the  image  hash  both  with 
the  embedded  image  hash  as  well  as  compared  with  the 
notes  obtained  from  the  acquiring  agent . 

THE  COURT:     Can  I  interrupt  you  for  just  a 
minute?     I  asked  where  did  the  computer  come  from. 
BY  MR.  MORROW: 

Q.  Mr.   Johnson,   where  was  this  computer  collected 

from? 

A.  The  computer  was  collected  from  PFC  Manning's 

housing  unit  in  Iraq  at  FOB  Hammer. 

Q.  And  what  kind  of  operating  system  did  this 

computer  have? 

A.  The  Mac  OS  10. 

Q.  And  what  is  Mac  OS  10? 

A.  OS  10  is  the  operating  system  used  by  Apple 

Computers  for  Macintosh  computers . 

Q.  And  when  was  this  operating  system  installed 

on  the  computer? 

A.  25  January  of  2010. 

Q.  And  how  do  you  know? 

A.  We  obtained  the  installation  log  from  the 
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operating  system  installation  log  of  the  hard  drive . 

Q.  And  where  is  the  installation  log  located  on 

the  computer? 

A.  The  system  log  folder. 

Q.  I'm  retrieving  prosecution  exhibit  126  for 

identification.     126  Alpha  and  Bravo.     Excuse  me. 

I'm  handing  the  witness  what's  been  marked  as 
prosecution  exhibit  126  Alpha  and  126  Bravo.     Just  feel 
free  to  extract  both. 

Mr.   Johnson,   do  you  recognize  that  document? 
A.  I  do. 

Q.  And  what  is  it? 

A.  This  is  the  contents  of  the  install  log 

obtained  from  the  Mac  Book  Pro ' s  hard  drive . 
Q.  Is  that  the  entire  install  log? 

A.  I  believe  it  is,  sir. 

MR.  MORROW:     Permission  to  publish  to  the 
court.   Your  Honor. 

THE  COURT:  Proceed. 
BY  MR.  MORROW: 

Q.  Mr.   Johnson,   I'm  going  to  show  you  126  Alpha 
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first.     Using  this  exhibit,   can  you  explain  your 
testimony  earlier  about  the  installation  of  the  operating 
system? 

A.  The  installation  log  is  created  by  the  OS  10 

and  it  logs  nxomber  of  actions  related  to  the  installation 
of  the  operating  system.     On  line  number  6  there  you  can 
actually  annotate  where  it's  starting  itself  on  January 
25. 

MR.   TOOMAN:     Your  Honor,   the  defense  will 
stipulate  that  the  operating  system  was  installed  on  25 
January . 

THE  COURT:     All  right. 
MR.  MORROW:  Okay. 
BY  MR.  MORROW: 

Q.  Mr.  Johnson,   I'm  going  to  show  you  page  two  of 

126  Bravo.     Can  you  explain  what  else  you  observed  in  the 
install  log? 

A.  If  you  look  at  line  nxomber  33  here,  you'll 

note  that  it ' s  wipe  and  secure  erase .     This  was  an  option 
selected  during  the  installation  to  securely  wipe  the 
hard  drive  during  the  installation  process  prior  to  the 
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(INAUDIBLE)   being  installed. 

Q.  Now,   what  do  you  mean  by  wipe  and  secure 

erase,  what  does  that  actually  mean?    What  is  the 
computer  actually  doing? 

A.  It's  clearing  the  storage  on  the  hard  drive 

and  writing  out  with  zeroes . 

THE  COURT:     What  line  is  that? 
THE  WITNESS:     Line  niomber  33,  ma'am. 
MR.  MORROW:     Your  Honor,   the  government  moves 
to  admit  prosecution  exhibit  Alpha  and  Bravo  126  for 
identification . 

MR.   TOOMAN:     No  objection. 
THE  COURT:     May  I  see  them,  please? 
Prosecution  exhibits  126  Alpha  and  Bravo  are  admitted. 
BY  MR.  MORROW: 

Q.  Mr.   Johnson,   what  was  your  investigative  plan 

for  the  computer? 

A.  In  this  case  we  were  looking  for  evidence  of 

chat  communications  or  indications  of  classified 
information . 

Q .  So  what ' s  the  first  thing  you  did? 
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A.  We  were  looking  to  see  if  there  was  any  chat 

programs  installed  on  this  program  —  on  the  computer, 
and  if  so,  what  information  may  have  been  logged. 
Q.  And  what  did  you  find? 

We  identified  the  ADM  program  was  installed. 
And  what  is  ADM? 

ADM  is  a  chat  program  used  on  the  OS  10 . 
And  did  you  find  any  chat  logs  in  the  ADM 


A 

Q 
A 

Q 

program? 
A. 

Q. 
A. 

Q. 


We  did. 

And  who  are  those  chats  between? 
Private  Manning  and  Adrian  Lamo. 
Did  the  ADM  application  contain  evidence  of 
any  other  communications? 

A.  Yeah.     We  looked  in  PFC  Manning's  buddy  list 

for  the  ADM  program  to  see  who  else  he  might  have  been 
communicating  with.     We  identified  one  entry  that  was  of 
interest  indicating  the  chat  account  pressassociation  was 
associated  with  an  alias  of  Julian  Assange . 

Q.  All  right.     Let's  back  up  a  little  bit. 

What's  a  buddy  list? 
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A.  Buddy  list  is  your  list  of  friends  or  contacts 

that  you  would  be  chatting  with  in  a  chat  program. 

Q .  And  what  is  an  alias  that  you ' re  talking  about 

in  this  context? 

A.  In  this  context  an  alias  would  be  a  nickname 

or  user  supplied  contact  name . 

Q.  And  the  name  Julian  Assange  was  associated 

with  what  account? 

A.  The  chat  account  pressassociation . 

Q.  I'm  showing  you  what's  been  marked  as 

prosecution  exhibit  120  for  identification.     I'm  handing 
the  witness  what's  been  marked  as  prosecution  exhibit  120 
for  identification. 

Do  you  recognize  those  images,  Mr.  Johnson? 

A .  I  do . 

Q.  And  what  are  they? 

A.  The  first  one  here  is  the,   an  excerpt  of  the 

buddy  list  showing  the  contact  pressassociation 
associated  with  Julian  Assange.     The  second  is  an  excerpt 
obtained  from  an  unallocated  cluster  referring  to 
pressassociation  from  with  the  alias  of  a  Nathaniel 
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Frank . 

MR.  MORROW:     Permission  to  pxiblish.  Your 

Honor . 

THE  COURT:  Granted. 
BY  MR.  MORROW: 

Q .  All  right .     Let ' s  look  at  page  one  of 

prosecution  exhibit  120  for  ID.     Can  you  just  repeat  or 
just  explain  the  image  as  it  appears  on  the  screen, 
please? 

A.  Yeah.     This  is  an  excerpt  contained  from  the 

buddy  list.     It  shows  the  buddy  account  of  dog  network, 
which  is  associated  with  PFC  Manning  on  his  computer . 
The  chat  remote  person  is  pressassociation  at  jabber  dot 
DE  which  I  typically  refer  to  as  pressassociation,  the 
alias  below  it,   Julian  Assange  is  the  nickname. 

Q.  Was  jabber  dot  DE? 

A.  That  is  a  remote  host  that  is  used  for  Jabber 

Communications . 

Q.  And  what's  Jabber? 

A.  Jabber  is  a  chat  network,   it's  used  by  a 

nxomber  of  sources .     Until  fairly  recently  it  was  very 
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similar  to  Google  Talk. 

Q.  And  where  did  you  find  this  on  the  computer? 

A.  This  one  was  found  in  the  ADM's  configuration 

folder . 

Q.  On  so  on  the  allocated  or  unallocated  side? 

A.  This  one  was  allocated,  sir. 

Q.  I'm  going  to  show  you  page  two  of  prosecution 

exhibit  120  for  ID.     Can  you  explain  this  image,  please? 

A.  This  one  is  an  excerpt  taken  from  an 

unallocated  cluster  which  appears  to  have  been  a  deleted 
or  removed  entry  for  that  same  pressassociation  account, 
also  associated  with  dog  network.     This  time,  however, 
it ' s  showing  the  alias  of  Nathaniel  Frank . 

Q.  And  where  did  you  find  this  information  on  the 

computer? 

A.  This  is  in  an  unallocated  cluster,  sir. 

Q.  Again,  what  does  that  mean  for  the  for  the 

court  ? 

A.  An  unallocated  cluster  is  deleted  contents  of 

former  files . 

MR.  MORROW:     Your  Honor,  prosecution  moves  to 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/12/13  Morning  Session 

15 

admit  prosecution  exhibit.  120  for  ID  into  evidence. 
MR.   TOOMAN:     No  objection. 
THE  COURT:     Prosecution  exhibit  120  for 
identification  is  admitted. 
BY  MR.  MORROW: 

Q.  Now,  Mr.  Johnson,  we  talked  about  this  before, 

but  how  do  you  search  allocated  space  on  a  computer? 

A.  It  would  depend  on  the  situation.     Often  times 

we're  using  keyword  searches  for  things  we  already  know. 

Q.  Just  can  you  give  me  an  example? 

A.  For  example,   in  this  case  I  would  be  looking 

for  pressassociation  or  Nathaniel  Frank. 

Q.  And  so  you'd  use  —  how  would  you  use  that 

keyword  with  a  forensic  tool? 

A.  We  use  the  keyword  search  in  the  EnCase  tool 

to  find  matches . 

Q.  So  after  you  found  the  pressassociation 

account  in  the  unallocated  space,  what  did  you  do  next? 

A.  Well,   now  that  we  have  an  additional  alias 

Nathaniel  Frank,   we're  going  to  look  for  other  chats  with 
that  alias  with  pressassociation  to  see  if  there  was  any 
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other  remnants  of  that  account. 

Q.  And  what  did  you  find? 

A.  We  found  a  large  list  of  other  what  appear  to 

be  chats  with  Nathaniel  Frank,  between  Nathaniel  Frank 
and  Bradley  Manning. 

Q.  And  where  did  you  find  these  chats  on  the 

computer? 

A.  Unallocated  space,  sir. 

Q.  And  were  these  chats,  was  it  all  in  one  file, 

like  all  put  together? 

A.  No.     They  were  in  a  nxomber  of  chunks,   split  up 

in  the  unallocated  space. 

Q.  And  were  the  chats  readable  to  hxomans? 

A.  They  are  readable,  but  they  are  fragments  of 

XML  used  by  ADM,   so  they ' re  readable  but  they ' re  not  easy 
to  read  by  a  hxoman. 

Q.  You  said  XML.     What  is  XML? 

A.  XML  is  a  language  used  by  a  ntmiber  of 

applications,   web  browsers  and  other  applications.  It's 
intended  for  ease  of  computers  to  parse  data .     It ' s  not 
really  intended  for  hxoman  consxomption,  but  it  is 
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readable . 

Q.  Now,   when  you  read  through  the  contents  of 

these  chat  logs  in  the  unallocated  space,  what  is  the 
subject  matter? 

A.  They  appear  to  be  discussing  government 

information . 

Q.  Now,  my  understanding  of  unallocated  space  is 

that  there's  generally  not  a  date  associated  with  the 
information.     Do  these  chat  logs  have  dates? 

A.  Yes,   they  did.     That's  true,   when  in 

unallocated  space  we  often  lose  the  metadata  associated 
with  the  file  because  the  file  is  no  longer  there. 
However,   in  this  particular  case  the  date  and  time  with 
the  chats  is  actually  logged  as  part  of  the  chat  log 
entry,   so  it  was  recoverable. 

Q.  Once  you  identified  the  chats  in  the 

unallocated  space,  what  did  you  do  next? 

A.  After  we  identified  the  entries,  we  carved 

them  out  using  EnCase,    sent  them  out  to  an  external  file 
so  I  could  make  them  more  easy  to  read. 

Q.  And  what  form  did  you  put  the  chats  in? 
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A.  I  converted  them  to  an  Excel  spreadsheet. 

Q.  Now,   when  you  converted  them  to  an  Excel 

spreadsheet,  did  alter  the  files? 
A.  No,  sir. 

Q.  And  how  did  you  organize  these  chats  in  the 

spreadsheet  ? 

A.  They  were  organized  by  date  and  time. 

Q.  I'm  showing  you  what's  been  marked  as 

prosecution  exhibit  123  for  identification. 

I'm  handing  the  witness  what's  been  marked  as 
prosecution  exhibit  123  for  identification. 

Mr.   Johnson,   do  you  recognize  that  document? 

A .  I  do . 

Q.  And  what  is  it? 

A.  This  is  the  contents  of  the  spreadsheet  I 

created  in  the  chat  extracted  in  unallocated  space 
between  Bradley  Manning  and  the  alias  of  Nathaniel  Frank . 

Q.  Permission  to  —  actually,  hold  on  a  second. 

Now,   did  you  create  this  document? 

A.  Yes,  sir. 

Q.  And  I  assTome  when  you  created  the  docxoment  it 
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was  a  digital  file,   is  that  correct? 
A.  Yes,  sir. 

Q.  Is  this  how  the  document  would  appear  if 

printed? 

A.  Yes,  sir. 

MR.  MORROW:     Your  Honor  —  well,  more 

questions . 

Q.  What's  the  first  date  of  the  chats  that  you 

were  able  to  recover? 

A.  March  5,  2010. 

Q.  And  what  was  the  last  date  of  the  chats? 

A.  March  18. 

Q.  Now,   did  you  recover  chats  for  every  day  in 

between  March  5  and  March  18? 

A.  I  don't  believe  we  have  every  single  date.  I 

don't  recall  specifically. 

No,   there  are  dates  missing,  sir. 

Q.  Now,   is  this  the  extent  of  the  chats  you  were 

able  to  recover  in  the  unallocated  space? 

A.  Yes,  sir. 

Q.  And  you  said  something  about  government 
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information  earlier .     What,  government  information  did 
they  discuss  or  did  the  parties  discuss  in  the  chat  logs? 

A.  They  have  a  variety  of  topics  here. 

Specifically  they  were  mentioning  Iceland,  Iraq, 
Afghanistan  and  Gitmo . 

Q.  And  do  the  parties  discuss  WikiLeaks? 

A.  Yes,  sir. 

MR.  MORROW:  Your  Honor,  at  this  time  the 
prosecution  moves  to  admit  prosecution  exhibit  123  for 
identification  into  evidence . 

MR.   TOOMAN:     No  objection,  ma'am. 
THE  COURT :     All  right .     Prosecution  exhibit 
123  is  admitted. 
BY  MR.  MORROW: 

Q.  Mr.  Johnson,   let's  talk  about  some  of  your 

other  findings .     Did  you  find  any  evidence  of  connections 
between  this  computer  and  other  computers? 

A.  Yes,  sir. 

Q.  Can  you  explain,  please? 

A.  Earlier  during  chat  communications  with  Mr. 

Lamo  he  had  discussed  using  SSH  or  SFTP  to  transfer 
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files,   so  I  looked  to  see  if  he  actually  was  using  SSH  or 
SFTP. 

Q .  All  right .     So  let ' s  go  very  slowly . 

THE  COURT:     I  was  going  to  ask  you,   if  you 
could  speak  just  a  little  more  slowly.     I'm  having 
difficulty  understanding  you. 

THE  WITNESS:     Sorry,   Your  Honor. 
Q.  What  is  SSH? 

A.  Secure  shell.      It  is  a  computer  program  or 

computer  protocol  used  for  creating  encrypted 
communication  link  between  remote  computers . 

Q.  And  what  is  SFTP? 

A.  SFTP  is  a  STibset  or  works  in  conjunction  with 

SSH.  It  stands  for  the  secure  file  transfer  protocol. 
It  is  to  allow  for  transferring  the  files  over  the  SSH 
communication  link . 

Q.  Now,   when  you  looked  at  the  —  first  of  all, 

where  did  you  find  this  SSH  information? 

A.  We  found  it  in  the  known  hosts  file.     That  is 

a  file  that  contains  pxiblic  key  information  of  remote 
hosts  that  have  been  connected  to  at  least  once. 
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Q.  And  what  do  you  mean  by  piobllc  key 

information? 

A.  SSH  using  pxiblic  key  cryptography  to  handle 

the  encryption  between  the  hosts .     The  public  key  is 
stored  locally  so  that  you  are  able  to  encrypt  the 
communication  to  the  remote  recipient . 

Q.  And  what  did  you  observe  in  this  known  host 

file? 

A.  Well,   we  saw  several  IP  addresses  and  a  URL 

connecting  to  ports  that  are  unusual  for  SSH.     They  stood 
out  because  of  that . 

Q.  And  were  you  able  to  resolve  where  these 

connections  were  made  to? 

A.  Yes,  sir. 

Q.  And  where  were  they  made  to? 

A.  The  IP  addresses  and  domain,   one  of  them 

traced  back  by  investigations  to  Verizon  Communications 
that  ultimately  resolved  back  to  Bradley  Manning ' s  aunt . 
The  others  resolved  back  to  an  ISP  known  as  PRQ  known  to 
be  associated  with  WikiLeaks. 

Q.  And  did  you  find  any  emails  on  the  computer? 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/12/13  Morning  Session 

23 

A.  We  did. 

Q.  And  where  did  you  find  emails? 

A.  In  his  Thunderbird  email  cache. 

Q.  And  what  is  Thunderbird? 

A.  Thunderbird  is  a  client  email  program  similar 

to  Outlook  used  on  a  number  of  systems  including  Mac. 

Q.  And  when  you  say  email  cache,  what  do  you  mean 

by  that? 

A.  There's  actually  email  in  this  cache  of  a 

Gmail  account  which  is  usually  a  storage  server  site,  but 
when  it's  online  with  Thunderbird  it  will  download. 

Q.  So  this  email  was  stored  locally  on  the 

computer? 

A.  Yes,  sir. 

Q.  And  what  did  you  do  with  the  email  you  found 

on  this  computer? 

A.  We  looked  at  the  email  to  see  if  there  was  any 

relevant  content . 

Q.  And  what  do  you  mean  by  relevant  content,  what 

were  you  looking  for? 

A.  Specifically  classified  information. 
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discussions  of  government,  information  and  the  like . 

Q.  And  what  did  you  find  in  this  email? 

A.  Well,   they  identified  a  nxomber  of  PGP  or  GPG 

encrypted  emails . 

Q .  All  right .     Let ' s  start  slowly  with  that 

again.     What's  PGP? 

A.  PGP  is  pretty  good  privacy,   a  public  key  based 

encryption  method  used  predominantly  with  email  and  GPG 
is  the  open  source  clone  of  that . 

Q.  So  they're  basically  the  same? 

A.  They  are  entirely  compatible  with  one  another. 

Q.  Now,  you  said,  were  these  messages  encrypted? 

A.  Yes,  sir. 

Q.  Did  you  find  unencrypted  messages? 

A.  I  did. 

Q.  And  was  there  anything  of  interest  in  some  of 

the  unencrypted  messages? 

A.  The  unencrypted  message  indicated  potentially 

a  discussion  of  classified  information. 

Q.  So  let's  go  back  to  you  mentioned,  you 

mentioned  p\jblic  keys  a  ntmiber  of  times.     If  an  email  is 
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encrypted,   how  does  the  other  party  read  the  email? 

A.  With  pxiblic  key  cryptography,   in  the  case 

of  — 

Q.  Can  you  speak  up  a  little  bit,  Mr.  Johnson? 

A.  I'm  sorry.     Pardon  me.     I'm  not  a  loud  talker. 

Public  key  cryptography  is  a  concept  of  you 
only  want  the  authorized  recipient  to  be  able  to  decrypt 
your  message.     PGP  does  this  and  so  does  (INAUDIBLE) 
based  authentication,   they  use  the  same  principles.  The 
pxiblic  key  is  from  the  recipient  you  have  a  corresponding 
secret  key.     They  work  mathematically  with  each  other,  so 
I  can  encrypt  messages  to  someone  and  I  can  receive 
messages  from  them,  but  only  that  person  can  decrypt 
them. 

Q.  Now,   how  does  a  forensic  examiner  go  about 

decrypting  email  they  find? 

A.  Well,   on  this  particular  machine  I  can  only 

decrypt  the  information  that ' s  been  sent  to  me .     I  cannot 
see  the  messages  that  are  being  sent  out  because  I  don't 
have  the  recipient ' s  public  key,  but  I  do  have  the  secret 
key  for  PFC  Manning  because  it ' s  on  his  computer .     All  I 
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have  to  identify  is  the  password  necessary  to  open  that 
private  key. 

Q.  And  were  you  able  to  find  the  password  for 

this  private  key? 
A .  I  was . 

Q.  And  how  did  you  locate  that? 

A.  Well,   when  we  have  to  decrypt  things,  we  have 

to  try  to  figure  out  what  the  password  is,   one  of  the 
things  we  look  at  is  has  he  used  passwords  that  we  know 
of  from  his  past .     In  the  past  his  password  was  the  same 
as  the  log-in  password  for  the  Mac. 

Q.  And  what  do  you  mean  by  a  log-in  password  for 

the  user? 

A.  All  user  accounts  on  the  Mac  are  going  to  be 

password  protected.     They're  normally  set  up  at 
installation  or  possibly  changed  at  a  later  date,   even  if 
the  machine  is  set  to  auto  log  on.     In  this  case  the 
password  is  actually  stored  on  the  hard  drive,  we  use  a 
tool,   the  Mac  forensics  lab,   to  extract  that  log  word.  I 
can  then  compare  it  against  the  PGP  and  try  it,   and  it 
worked . 
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Q.  So  the  Mac  word  password  was  used  on  the 

private  key  in  this  case? 
A.  Yes. 

Q.  Now,   once  you  figured  that  out,   what  were  you 

able  to  do? 

A.  At  this  point  I  can  then  run  the  encrypted 

messages  through  PGP  myself  and  decrypt  them. 

Q.  And  did  you  review  the  decrypted  email? 

A.  I  did. 

Q.  And  what  did  you  find? 

A.  I  found  discussions  of  classified  information, 

specifically  Bradley  Manning's  role  in  the  release  of  the 
Granahi  video . 

THE  COURT:     Can  you  say  that  one  more  time? 

THE  WITNESS:     Specifically  his  involvement  in 
the  release  of  the  collateral  murder  video. 


BY  MR.  MORROW: 

Q.  I'm  showing  you  prosecution  exhibit  41? 

I'm  handing  the  witness  what's  been  marked  as 
prosecution  exhibit  41  for  identification. 
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A.  Yes,  sir. 

Q.  Do  you  recognize  that  doc\ament? 

A.  I  do. 

Q.  And  what  is  it? 

A.  This  is  one  of  the  emails  between  Bradley 

Manning  and  Mr.  Eric  Schmiedel  obtained  from  his  email 
account  discussing  classified  information. 

Q.  And  can  you  just  read  —  well,   actually  let  me 

—  permission  to  publish  to  the  court.   Your  Honor. 
THE  COURT:     Go  ahead. 

MR.  MORROW:     I'm  just  going  to  publish  page 

one . 

BY  MR.  MORROW: 

Q.  Mr.   Johnson,   is  this  the  email  you  reviewed  in 

PFC  Manning's,   or  at  least  one  of  emails  you  reviewed? 

A.  Yes,  sir. 

Q.  And  just  can  you  point  out  in  the  email  the 

information  we ' re  talking  about  earlier? 

A.  In  this  case  what  you  can  see  here  is  an  email 

thread.  If  you  look  about  three-fourths  of  the  way  down 
you  can  see  where  you ' re  seeing  Bradley  Manning ' s  reply . 
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This  is  an  answer,    I  have  various  other  questions,  and 
the  very  next  line  there,   I  approve  the  edits  without 
reviewing  the  video.     If  you  go  back,   you  can  see  from 
this  whole  thing  at  the  top  here,  my  objection  to 
collateral  murder .     This  whole  email  is  in  relation  to 
the  collateral  murder  video. 

Q.  And  does  the  email  discuss  other  government 

information  that  PFC  Manning  allegedly  compromised? 

A.  Yes,   sir.     We  have  a  number  of  state 

department  cables  being  discussed. 

MR.  MORROW:     Your  Honor,  the  prosecution 
moves  to  admit  prosecution  exhibit  41  for  identification 
into  evidence . 

MR.   TOOMAN:     No  objection,  ma'am. 

THE  COURT:     May  I  see  it,  please? 

Prosecution  exhibit  41  for  identification  is 

admitted. 

BY  MR.  MORROW: 

Q.  Mr.   Johnson,    I  want  to  talk  or  shift  to  some 

of  the  capabilities  of  this  computer .     Did  this  computer 
have  a  CD  or  a  DVD  system? 
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A.  It  did. 

Q.  And  are  there  any  ways  to  tell  whether  a  CD 

has  been,   a  CD  or  a  DVD  has  been  written  to  or  erased? 
A.  Yes,  sir. 

Q.  And  how  would  you  tell  this? 

A.  In  this  case  the  operating  system  contains  a 

disk  recording  log  that  keeps  track  of  the  ntimber  of 
actions  related  to  the  operation  or  eraser  or  erasure  or 
re— erasure  of  rewritable  disks . 

Q.  And  where  did  you  find  this  disk  recording 

log? 

A.  It ' s  in  the  log  folder. 

Q.  And  how  is  this  information  created? 

A.  It's  maintained  by  the  operating  system 

itself . 

Q.  And  when  you  reviewed  the  disk  recording  log, 

what  did  you  find? 

A.  We  found  indications  of  a  number  of  optical 

media  being  written  and  erased. 

Q.  Say  that  again,  please. 

A.  Written  and  erased. 
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Q .  I'm  going  to  show  you  what ' s  been  marked  as 

prosecution  exhibit  124  for  ID. 

I'm  handing  the  witness  has  been  marked  as 
prosecution  exhibit  124  for  identification. 

Mr.   Johnson,   can  you  review  that  docxoment. 


please? 
A 

Q 
A 

Q 


It '  s  the  wrong  docxoment . 
Do  you  recognize  the  docxament? 
This  is  the  utility  log. 

I'm  sorry.     I  retrieved  the  wrong  exhibit.  My 
apologies .     One  moment . 

What  is  the  document,  Mr.  Johnson? 
A.  This  is  the   (INAUDIBLE)  what  appears  to  be  the 

disk  utility  log.      I'm  sorry,    sir.     This  is  correct. 
This  is  the  — 

THE  COURT:     I'm  sorry.     It's  a  what? 
THE  WITNESS:     Disk  recording  log. 
THE  COURT:     Disk  recording  log. 
THE  WITNESS :      I  do  apologize .      I  was  thrown 
off.     I  was  seeing  this  without  the  line  nxjmbers  until 
today . 
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BY  MR.  MORROW: 

Q.  Did  you  extract  that  doc\ament? 

A.  Yes,  sir. 

Q.  Now,   what's  different  from  this  document  from 

what  you  extracted? 

A.  It  has  had  line  ntunbers  appended  to  it  for 

clarity. 

MR.  MORROW:     Permission  to  pxiblish.  Your 

Honor . 

THE  COURT:     Go  ahead. 
BY  MR.  MORROW: 

Q.  I'm  showing  you  page  one  of  the  disk  recording 

log.     Mr.   Johnson,  when  was  the  first  recording  of  a  disk 
being  written  to? 

A.  The  log  was  indicating  the  first  one  in  this 

case  was  January  30,  2010. 

Q.  And  I'm  going  to  show  you  the  last  page  of 

this  exhibit,  page  five.     What  is  the  last  recording  in 
this  case? 

A.  April  30,  2010. 

Q.  And  what's  that  showing  in  line  189? 
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A.  That  an  erasure  has  occurred. 

Q.  And  what  does  that  mean? 

A.  A  rewritable  disk,   in  this  case  a  CD 

rewritable,   has  been  erased. 

Q.  Now,   I  showed  you  the  other  page  of  this  log; 

what  type  of  information  is  contained? 

A.  You'll  see  a  ntmiber  of  those  series  of  both 

erasures  and  burns . 

MR.  MORROW:     Your  Honor,   the  prosecution 
moves  to  admit  prosecution  exhibit  124  for  identification 
into  evidence . 

MR.  TOOMAN:  No  objection.  Your  Honor. 
THE  COURT:     Prosecution  exhibit  124  is 

admitted. 

BY  MR.  MORROW: 

Q.  Now,   this  disk  recording  log,   could  you  tell 

what  files  are  on  those  CDs? 

A.  No,  sir. 

Q.  And  at  any  time  in  this  case  or  during  your 

examination  did  you  search  for  file  names  that  may  have 
been  on  CDs  that  were  burned  or  erased? 
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A.  Yes,  sir. 

Q.  And  what  did  you  find? 

A.  Previously  I  had  identified  a  CD  that  had  been 

obtained  from  PFC  Manning's  (INAUDIBLE)  made  in  Iraq.  We 
had  a  file  name  on  that  disk  that  was  provided  to  me .  We 
searched  for  that  file  name  on  the  disk  image  of  his  Mac . 

Q.  And  do  you  recall  the  file  name? 

A.  I  don't  recall  the  entire  file  name,  but  it 

was  partially  engagement  video . 

Q .  I'm  going  to  show  you  what ' s  been  marked  as 

prosecution  exhibit  121  for  identification. 

I'm  handing  the  witness  what's  been  marked 
prosecution  exhibit  121  for  identification.     Do  you 
recognize  that  document? 

A .  I  do . 

Q.  And  what  is  it? 

A.  This  is  a  portion  of  unallocated  space,  a 

carve  out  portion  that  shows  the  file  name  in  question  in 
conjunction  with  some  other  text,    specifically  the  word 
volxomes  and  what  appears  to  be  additional  file  names . 

MR.  MORROW:     Permission  to  p\jblish.  Your 
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Honor . 

THE  COURT:  Yes. 
BY  MR.  MORROW: 

Q.  Mr.   Johnson,   let's  go  through  this  just 

slowly.     How  is  this  document  or  image  created? 

A.  We're  looking  at  the  unallocated  clusters  in 

EnCase  in  a  raw  format .     Since  we  don ' t  have  file  or 
allocated  information,  we  have  to  actually  look  at  it 
raw.     What  you're  seeing  here  is  a  snippet  of  that 
information  it  pulled  from  that  as  I  would  see  it  in 
EnCase ' s  viewer . 

Q.  Now,   using  this  image,   can  you  describe  for 

the  court  the  keyword  you  searched? 

A.  If  you  look  right  there  sort  of  in  the  middle 

of  the  page  the  July  07  CD  engagement  zone,  the 
engagement  zone  is  what  I'm  looking  for.     You  can  see  the 
area  around  it  is  information  that  was  obtained  or 
related  to  it,   specifically  to  the  left  you  can  see  the 
word  volumes  and  some  numbers . 

Q.  And  what  does  volxomes  mean  to  you? 

A.  On  the  Mac  operating  system  the  volumes  is 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/12/13  Morning  Session 

36 

used  as  a  mounting  point,   that  being  you  have  to  attach 
external  media  or  removable  media,  whether  that  was  CD, 
DVD,  external  hard  drives,  they  have  to  be  attached  to 
the  system  to  use  them.     Mac  uses  the  word  volumes  as 
their  mounting  point . 

Q.  What  does  voltimes  indicate  to  you  then? 

A.  Seeing  a  fragment  like  this  in  conjunction 

with  a  file  name  that  I'm  looking  for  would  indicate  to 
me  that  a  file  with  that  name  was  possibly  contained  on 
external  media. 

Q.  External  media  that  was  inserted  into  the 

computer? 

A.  Yes,  sir. 

Q.  Now,   once  you  found  this  excerpt  in  the 

unallocated  space,  what  did  you  do  next? 

A .  Now  that  I  see  that  he ' s  got  external  media 

with  content  that's  potentially  relevant,   I  want  to  see 
if  there's  anything  else  of  similar  nature,   so  I'm 
looking  for  other  volumes  that  might  have  been  attached. 

Q.  And  what  did  you  do  when  you  —  did  you  find 

any  other  volxomes  that  might  have  been  attached  or  any 
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evidence  of  any  external  media  being  attached? 
A.  I  did. 

Q.  And  what  did  you  do  once  you  found  those  other 

references? 

A.  I  went  to  find  the  other  volxomes  by  using  a 

pattern,   and  doing  so  I  found  a  large  number  of  matches 
for  the  pattern.     After  I  found  those  I  identified  all  of 
them  and  extracted  them  at  my  examination  work  station. 

Q.  I'm  showing  you  what's  been  marked  as 

prosecution  exhibit  127  for  identification. 

Mr.   Johnson,   I'm  handing  you  what's  been 
marked  as  prosecution  exhibit  127  for  identification. 
I'm  going  to  hand  the  court  reporter  121  for 
identification . 

Do  you  recognize  that  docxament? 

A.  I  do. 

Q.  And  what  is  it? 

A.  This  is  the  contents  of  a  text  file  that  I 

created  showing  all  of  the  volumes  we  extracted  from 
unallocated  space . 

Q.  And  how  did  you  create  this  file? 
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A.  After  we  find  all  the  matches  in  unallocated 

space,  we  carve  out  just  the  portion  relevant.  I'm 
looking  for  in  this  case  file  path.     I  had  pulled  them 
out  into  a  text  file  where  I  can  manipulate  it  to  make  it 
easier  to  read,   in  this  case  reducing  duplicates,  sorting 
it  and  creating  this  document . 

MR.  MORROW:     Permission  to  publish.  Your 

Honor . 

THE  COURT:     Go  ahead. 
BY  MR.  MORROW: 

Q.  Mr.   Johnson,   I'm  just  going  to  show  you  the 

first  page.     Can  you  see  that? 

A.  Yes,  sir. 

Q.  Can  you  —  how  did  you  organize  this  dociament? 

A.  It  was  sorted. 

Q.  Sorted  by  what?     Is  this  sorted  by  date? 

A.  Yes,  sir. 

Q.  Let's  just  go  through  one  line,   we'll  say  line 

seven .     Can  you  just  explain  from  left  to  right  the 
information? 

A.  Sure.     What  you  see  here  after  it  was 
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extracted  is  what  appears  to  be  the  full  path,   the  voliame 
being  the  mount  that  I  discussed  earlier.     The  next  thing 
would  be  the  volume  name .     It  has  to  have  some  sort  of 
name,   so  in  this  case  it  appears  to  be  using  a  date  and 
time  as  its  name,   which  is  common.     And  then  the  last 
portion  there  you  see  line  seven,   10  Reykjavik  21  would 
likely  be  a  file  name . 

Q.  Now,   let's  just  back  up  a  little  bit.     I  see 

100215  underscore  0621  in  line  seven.     What  does  that 
mean? 

A.  As  I  mentioned,   all  volumes  or  external  media 

has  to  have  a  name  of  some  sort.     If  you  don't  specify 
one,   whatever  application  is  used  to  create  it  will  have 
to  come  up  with  one,   and  in  most  of  those  cases  a  date 
and  time  is  used  as  a  default  and  that  appears  to  be  the 
case  here . 

Q.  And  would  a  Roxio  program  create  that  kind  of 

default  file  name? 

A.  I  believe  it  does,  sir. 

MR.  MORROW:     Your  Honor,  the  prosecution 
moves  to  admit  prosecution  exhibit  127  for  identification 
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into  evidence . 

MR.   TOOMAN:     No  objection,  ma'am. 

THE  COURT:     May  I  see  it,  please? 

Prosecution  exhibit  127  is  admitted. 
BY  MR.  MORROW: 

Q.  Now,  Mr.  Johnson,  what  was  significant  about 

some  of  the  file  names  you  saw  in  the  prosecution  exhibit 
127? 

A.  They  appear  to  have  a  similar  or  identical 

format  to  message  record  niombers . 

Q.  And  what  about  some  of  the  others  that  are 

non-state  department  information? 

A.  Could  you  be  more  specific,  sir? 

Q.  For  example,   Farah  dot  zip  I  believe  was  on 

page  two. 

A .  Okay . 

Q.  Was  there  any  evidence  of  that  file  name  being 

on  PFC  Manning's  SIPRNET  computers? 

A.  I'm  sorry,    sir.     Did  you  say  SIPRNET 

computers? 

Q .  Yes . 
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A.  I  believe  that  information  was  discovered  by 

our  agents,  yes,  sir. 

Q.  Now,   let's  actually  just  roll  back  to  some 

other  information  on  the  computer .     Did  you  find  any 
evidence  of  state  department  classified  information  or 
unclassified  information  on  the  personal  computer  of  PFC 
Manning? 

A.  Yes,  sir. 

Q.  And  what  did  you  find? 

A.  We  found  a  number  of  references  to  message 

record  numbers  which  is  a  very  unique  structure . 
Q.  And  where  did  you  find  that? 

A.  Unallocated  space,  sir. 

Q.  And  in  the  unallocated  space  or  the  allocated 

space,  did  you  find  any  state  department  messages  that 
were  decoded  in  base64? 

A.  No,  sir. 

Q.  Did  you  find  anything  that  would  encode  a 

cable  or  state  department  cable  in  base64? 
A.  Yes,  sir. 

Q.  And  what  did  you  find? 
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A.  We  identified  what  appears  to  be  processing 

script  intended  to  convert  information  from  a  cable  to  a 
base 6 4  common  separated  value  format . 

Q.  And  did  you  attempt  to  use  this  script? 

A.  I  did. 

Q.  And  just  describe  the  process  of  using  the 

script,    just  go  through  it  with  the  court,  please. 

A.  Well,   after  we  review  the  contents  of  the 

script,  we  actually  read  through  the  content  to  see  what 
it  might  do .     We  can  see  some  very  distinct  things .  It 
has  fields  related  to  message  record  niombers, 
classification  in  base64 .     We  also  see  a  hard  coded  path 
pointing  directly  to  PFC  Manning's  directory.     After  we 
extracted  that  using  some  sample  of  cables  provided  and 
it  generated  the  output  expected. 

Q.  So  let's  take  the  50,000  foot  view.     What  did 

you  put  in  and  what  did  it  spit  out? 

A.  The  input  is  HTML  files  of  state  department 

files;   the  output  is  the  common  separated  value  files. 

Q.  And  with  base64  encoded? 

A.  Yes,  sir. 
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Q.  Now,   did  you  find  any  evidence  that  this 

computer  uploaded  information  to  the  WikiLeaks  website? 

A.  We  found  fragments  of  what  appear  to  be 

references  to  the  WikiLeaks  page  showing  uploads  of 
several  file  names,   specifically  file  segment  fragments 
to  a  WikiLeaks  page . 

Q.  And  where  did  you  find  this  evidence? 

A.  It's  in  unallocated,  sir. 

Q.  And  what  files  appear  to  have  been  uploaded  to 

the  WikiLeaks  web  page? 

A.  What  appear  to  be  file  name  fragments  are 

Farah  dot  RAR  in  segments . 

THE  COURT :     I'm  sorry . 

Q .  Spell  it  out .     When  you  say  Farah  dot  RAR,  I 

think  your  accent  may  be  confusing. 

A.  Farah  dot  RAR  is  F  A  R  A  H  dot  RAR. 

Q.  And  what  is  an  R  A  R  file? 

A.  RAR  is  an  RAR  archive.     It  is  a  compression 

and  archiving  format  very  similar  to  the  more  common  zip 
that  you ' re  probably  familiar . 

THE  COURT:      Like  a  zip? 
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THE  WITNESS:     Very  similar  to  a  zip  file, 

ma  'am. 

BY  MR.  MORROW: 

Q.  And  when  you  found  this  information,   did  you 

find  the  actual  files  in  this  part  of  the  computer? 

A.  No,  sir. 

Q.  So  what  exactly  did  this  information  convey  or 

what  did  it  tell  you  when  you  saw  this  information  in  the 
unallocated  space? 

A.  I'm  seeing  what  appears  to  be  these  file  names 

in  conjunction  with  URL,   indicating  in  conjunction  with 
what  appears  to  be  an  upload  URL.     Also,  there  was  a 
series  of  these  in  conjunction  with  one  another  also 
indicating  what  appear  to  be  dates  and  times .  And 
finally  at  the  end  of  that  the  phrase  upload  complete. 

Q.  Now,   when  you  say  there  was  a  series  of  them, 

were  they  separated  into  different  parts? 

A.  It  appeared  to  be  a  segmented  RAR  file.  What 

that  means  is  an  RAR  file  that  had  been  broken  up  into 
several  smaller  pieces  and  what  we ' re  seeing  here  is  the 
upload  of  each  segment . 
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Q.  Mr.   Johnson,    I  want,  to  shift  gears  for  a 

moment .     One  of  the  charges  in  this  case  involves  a  theft 
of  a  global  address  list .     Did  you  find  anything  related 
to  emails  or  global  address  lists  in  your  review  of  this 
computer? 

A.  I  did. 

Q.  And  what  did  you  find? 

A.  Two  specific  references  of  relevance. 

Q.  What  was  the  first  one? 

A.  The  first  one  appeared  to  be,   I  would  classify 

as  a  tasker  indicating  someone  requesting  that  the  global 
address  list  be  exfiltrated. 

Q.  I'm  retrieving  what's  been  marked  as 

prosecution  exhibit  122  for  identification. 

Mr.   Johnson,   I'm  handing  you  what's  been 
marked  as  prosecution  exhibit  122  for  identification .  Do 
you  recognize  that  image? 

A.  I  do. 

Q.  And  what  is  it? 

A.  This  is  the  contents  of  the  unallocated  space 

of  the  tasker  I  discovered. 
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Q.  And  is  that  the  entirety  of  the  tasker  that 

you  found? 

A.  It  seems  to  be  cut  off.     I  don't  recall  if 

there  was  any  more  at  the  bottom  of  this,  sir. 

Q.  If  there  was  more  in  the  tasker  would  you  have 

included  it  in  your  screen  shot? 

A.  Yes,  sir. 

MR.  MORROW:     Permission  to  pxiblish.  Your 

Honor . 

THE  COURT:     Go  ahead. 
BY  MR.  MORROW: 

Q.  Where  was  this  information  found  again? 

A.  Unallocated,  sir. 

Q.  And  how  did  you  find  it  in  the  unallocated 

space? 

A.  In  this  case  we  just  stumbled  upon  it  during 

our  examination  finding  it  in  other  things . 

MR.  MORROW:     Your  Honor,  the  prosecution 
moves  to  admit  prosecution  exhibit  122  for  identification 
into  evidence . 

MR.   TOOMAN:     No  objection. 
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THE  COURT:     Thank  you.     Prosecution  exhibit 
122  is  admitted. 
BY  MR.  MORROW: 

Q.  Mr.   Johnson,   what  was  the  —  you  mentioned 

there  were  two  things  you  found  that  were  of  interest . 
What  was  the  second  thing? 

A.  The  second  thing  was  a  large  niomber  of  what 

appear  to  be  exchange  formatted  email  addresses. 

Q.  And  what  do  you  mean  by  exchange  formatted 

email  address .     What  is  exchange? 

A.  Exchange  is  the  Microsoft  platform  for  email 

servers  and  infrastructure  of  email . 

Q.  And  you  said  these  were  email  addresses? 

A.  Yes,  sir. 

Q.  Approximately  how  many  email  addresses  did  you 


find? 


A 

Q 
A 

Q 
A 


A  large  number,   sir,   in  the  thousands. 
In  the  thousands? 
Yes,  sir. 

Now,  where  was  this  found  in  the  computer? 
Unallocated,   sir . 
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Q.  Mr.   Johnson,    it  appears  that  a  lot  of  the 

information  that  you  found  was  in  the  unallocated  space . 
Did  you  find  any  evidence  of  this  computer  being  wiped  at 
any  time? 

A.  Yes,  sir. 

Q.  And  where  did  you  find  that  evidence? 

A.  As  noted  earlier,   the  first  was,   it  was  wiped 

during  the  installation  process.     Also,  we  identified 
that  free  space  had  been  wiped  on  a  couple  of  occasions . 

Q.  And  what  do  you  mean  by  free  space? 

A.  Free  space  is  the  unallocated  clusters. 

Q.  And  where  did  you  find  that  evidence? 

A.  The  disk  utility  log. 

Q.  And  what  is  a  disk  utility  log? 

A.  A  disk  utility  log  is  a  log  file,  again, 

maintained  by  the  operating  system  in  conjunction  with 
the  use  of  the  disk  utility  program. 

Q.  And  is  that  log  created  by  a  user  or  is  it 

created  by  the  computer? 

A .  No .     It's  maintained  by  the  system  when  they 

use  a  disk  utility. 
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Q.  I'm  retrieving  what's  been  marked  as 

prosecution  exhibit  125  for  identification. 

Mr.   Johnson,   I'm  handing  you  what's  been 
marked  as  prosecution  exhibit  125  for  identification. 

A.  Okay,  sir. 

Q.  Do  you  recognize  that  document? 

A.  I  do. 

Q.  And  what  is  it? 

A.  This  is  the  contents  of  the  disk  utility  log 

obtained  from  PFC  Manning ' s  computer . 

Q.  And  how  was  that  document  created? 

A.  This  was  exported  from  the  disk  image  prior  to 

my  examination  on  the  system. 

Q.  Where  on  the  log  can  you  point  me  to  that  the 

free  space  was  wiped? 

A.  In  this  log  file  you  will  see  a  nxomber  of 

indications .     See  if  I  can  find  it . 

Q.  I  believe  it  would  be  towards  the  front. 

A.  Yeah.     Here  we  are.     Where  you  see  secure  free 

space  being  first,   in  this  case,  being  stopped. 

Q.  Stop  you  for  a  moment.     Permission  to  publish. 
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THE  COURT:     Go  ahead. 
Q.  I'm  going  to  pxiblish  page  two. 

Can  you  point  out  the  line,  Mr.   Johnson,  that 
indicates  that  the  free  space  was  wiped? 

A.  There  are  two.     The  first  one  you  see  in  line 

67  starts  the  process  of  running  the  secure  erase  free 
space  for  unallocated  clusters.     This  one  was  canceled, 
it  stopped. 

Q.  And  why  was  it  canceled? 

A.  My  experience  would  be  it  was  canceled  because 

MR.   TOOMAN:  Objection. 
THE  COURT:  Yes. 

MR.   TOOMAN:     This  witness  would  not  be  able 
to  testify  as  to  why.   Your  Honor,  this  particular  process 
was  canceled. 

THE  COURT:     You're  talking  about  line  67? 

THE  WITNESS:     That's  the  start,  ma'am.  It's 
a  block.     It  completes  at  line  76  in  this  block. 

THE  COURT :     Why  don ' t  you  ask  some  additional 
foundation  questions? 
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BY  MR.  MORROW: 

Q.  Mr.   Johnson,   I'll  refer  you  to  line  70.  What 

does  that  line  indicate  to  you? 

A.  It  indicates  the  option  is  usually  a  35  pass 

erase  option.     There  are  several  options  with  a  secure 
erase . 

Q.  Now,  what  does  a  35  pass  erase  option  mean? 

A.  35  passes  means  the  operating  system  will 

literally  wipe  the  drive  35  times . 

Q.  And  that's  an  option  that  you  can  select  when 

you ' re  choosing  to  — 

A.  Yes,   sir.     There  are  several  options,   35  pass 

being  one  of  them. 

Q.  Now,    I'll  refer  you  to  line  74.     Can  you 

explain  what's  conveyed  by  that  line? 

A.  It  indicates  that  it  was  stopped  in  43  seconds 

indicating  it  was  likely  canceled  because  it  would  not 
have  completed  in  43  seconds . 

Q.  And  how  long,    in  your  experience,   how  long 

does  a  35  pass  erase  take? 

A.  It  will  depend  on  the  size  of  the  drive,  but 
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many,  many  hours,   even  days  in  some  cases. 

Q.  And  now  I'll  refer  you  to  line  79.     What  does 

that  line  convey? 

A.  This  indicates  a  seven  pass  free  space  erase, 

another  option  available. 

Q.  And  again,  what  would  the  computer  do  with  a 

seven  pass  erase? 

A.  It  will  erase  seven  times  versus  35. 

And  what  was  the  result  of  that  seven  pass 


Q. 
erase? 
A 

Q 
A 

Q 
A 

Q 


This  pass  did  complete. 
And  how  do  you  know  that? 
It's  indicated  in  line  85. 
Line  85? 

Yes,   sir.     Or  line  85  or  line  86. 
And  how  long  did  it  take  for  the  computer  to 
complete  the  seven  pass  erase? 

A.  Three  hours  and  48  minutes. 

MR.   MORROW:     Your  Honor,   the  prosecution 
moves  to  admit  prosecution  exhibit  125  for  identification 
into  evidence . 
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MR.  TOOMAN:  No  objection,  ma'am. 
THE  COURT:  Can  I  see  it,  please? 
Prosecution  exhibit  125  for  identification  is 

admitted. 

BY  MR.  MORROW: 

Q.  Now,  Mr.  Johnson,  based  on  what  you  reviewed 

in  the  install  log  and  what  you've  reviewed  in  the  disk 
utility  log,   what  can  you  say  about  what  will  be  able  to 
be  recovered  from  this  computer? 

A.  All  we  can  say  is  all  of  the  allocated  files 

in  this  system  have  been  created  sxobsequent  to  its 
installation  on  January  25.     However,   all  of  the 
unallocated  is  after  the  last  free  space  wipe  on  January 
31. 

Q.  So  what  are  the  pertinent  dates  in  terms  of 

the  information  that  can  be  recovered  on  the  computer? 

A.  Nothing  can  be  recovered  prior  to  25  January, 

nothing  in  unallocated  space  can  be  prior  to  31  January. 

MR.   MORROW:     Thank  you,   Mr.  Johnson. 
MR.  TOOMAN:     Ma'am,  the  defense  requests  a 
ten  minute  comfort  break  before  we  have  cross 
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examination . 

THE  COURT:     Any  objection? 
MR.  FEIN:     No,  ma'am. 
(BRIEF  RECESS.) 

THE  COURT:     Let  the  record  reflect  all  the 
parties  present  when  the  court  recessed  are  again 
present.     The  witness  is  on  the  witness  stand. 

Anything  we  need  to  address? 

MR.   FEIN:     Yes,   ma'am.     Quickly  an 
administrative  note.     At  the  start  of  today's  session. 
Your  Honor,  there  were  12  members  of  the  media  in  the 
media  operations  center,   one  stenographer,  and  the  public 
affairs  office  will  be  able  to  accommodate  the  hot  spot 
being  with  the  stenographer  starting  today.     Also,  the 
overflow  trailer  as  of  the  end  of  this  previous  recess  or 
at  the  end  of  the  session,   going  into  the  recess,  was  not 
being  used.     The  spectator  area  in  the  court-martial 
presently  is  not  at  full  capacity. 

THE  COURT:     Thank  you.     Cross  examination. 
CROSS  EXAMINATION  BY  MR.  TOOMAN: 
Q.  Good  morning,  Mr.  Johnson. 
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A.  Good  morning. 

Q.  Mr.   Johnson,   I  want  to  start  just  by  talking  a 

little  bit  about  your  process  when  you're  doing  a 
forensic  analysis.     When  you  do  that  analysis  you're 
looking  for  clues  and  leads,  correct? 

A.  Yes,  sir. 

Q.  And  ultimately,   after  your  analysis  is  over, 

you're  going  to  create  a  report? 
A.  Yes,  sir. 

Q .  And  anything  that ' s  important  you ' re  going  to 

note  in  that  report,  correct? 
A.  Yes,  sir. 

Q.  I  want  to  talk  about  the  chats  that  you 

discussed  on  direct  examination  along  with,  between  PFC 
Manning  and  pressassociation . 

A.  Okay,  sir. 

Q.  You  went  through  those  chats  line  by  line, 

correct? 

A.  I  believe  so,  sir. 

Q.  Read  them  in  their  entirety? 

A.  Yes,  sir. 
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Q.  You  were  looking  for  leads  and  clues  within 

that  document? 

A.  Yes,  sir. 

Q.  You  would  agree  with  me  that  anywhere  in  that 

docToment  is  PFC  Manning  ever  asked  to  send  anything  to 
pressassociation? 

A.  I  don't  recall,   sir.     I  don't  believe  so. 

Q.  You  don't  recall  as  in  he  wasn't  asked  or 

you ' re  not  sure? 

A.  I'm  not  sure,   sir.     I  don't  recall  specifics. 

Q.  I'll  retrieve  prosecution  exhibit  123. 

Hand  this  to  the  witness.     I  know  it's 
lengthy,  Mr.   Johnson,  but  I'll  ask  you  to  look  through 
the  entire  chat  and  let  me  know  if  you  see  any  instance 
where  pressassociation  asks  PFC  Manning  to  send  them 
something . 

And  we  would  ask  the  government  if  they  are 
willing  to  stipulate  to  this  to  speed  this  along  without 
having  Mr .   Johnson  need  to  read  through  the  entire  chat . 

MR.  MORROW:     No,   Your  Honor. 

THE  COURT :     All  right .     The  government ' s  not 
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willing . 

A.  No,   sir,   I  don't  see  anything  that  would 

appear  to  be  a  direct  request . 

Q.  Okay.     Thank  you. 

You  would  also  agree  with  me,  now  that  you've 
reviewed  the  entire  docxament,   that  at  no  point  is  PFC 
Manning  asked  by  pressassociation,  hey,   do  you  have 
access  to  this,  or  do  you  have  access  to  that? 

A.  I  don't  see  any  direct  knowledge  of  that,  sir, 

no . 

Q.  So  they  never  asked  him,   hey.  Brad,   could  you 

get  us  this  thing? 

A.  No,  sir. 

Q.  There's  no  discussion  in  that  chat  of  a  most 

wanted  list,   is  there? 
A.  No,  sir. 

Q.  There's  no  reference  to  that  at  all  either  by 

pressassociation? 

A.  No,    sir,    I  don't  believe  so. 

Q.  And  my  client  never  references  a  most  wanted 

list? 
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A.  No,  sir. 

Q.  Now,   PFC  Manning  and  pressassociation  do  talk 

about  a  nxomber  of  classified  docxoments  in  those  chats, 
correct? 

A.  Yes,  sir. 

Q.  They  talk  about  the  Iraq  and  Afghanistan 

databases? 

A.  The  CIDNE  databases,  yes,  sir. 

Q.  And  through  your  forensic  examination  you 

determined  that  PFC  Manning  gave  those  SigActs,  the 
contents  of  those  databases,  to  WikiLeaks  around  3 
February,   is  that  correct? 

A.  Could  you  be  more  specific,  sir? 

Q.  Sure.     Over  the  course  of  your  forensic 

examination  you  all  were  able  to  determine  when  PFC 
Manning  gave  certain  items  to  WikiLeaks,  correct? 

A.  I  have  evidence  that  information  was  sent,  not 

specific  information. 

Q.  Okay.     Did  you  have  any  evidence  that  the 

CIDNE  databases  or  the  contents  of  the  CIDNE  databases 
were  sent  from  PFC  Manning  to  WikiLeaks? 
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A.  I  don't  recall  —  can  you  be  more  specific, 

specifically  what  you ' re  asking  for? 

Q.  Sure.     One  of  the  charges  against  my  client  is 

that  he  downloaded  the  SigActs  from  both  the  Iraq  and  the 
Afghanistan  CIDNE  databases  and  then  provided  those 
docToments  to  WikiLeaks . 

A.  Correct. 

Q.  Did  your  forensic  examination  uncover  any 

evidence  of  PFC  Manning  actually  getting  those  things? 

A.  I  don't  have  the  contents  of  information  to 

verify  whether  it  was  CIDNE  or  not . 

Q.  Okay.     Is  there  any  evidence  of  PFC  Manning 

getting  SigActs,   regardless  of  where  they  came  from? 

A.  The  same  thing,   sir.     I  don't  have  contents  to 

say  whether  it  was  a  SigAct  or  anything  else . 

Q.  Okay.     Do  you  have  any  forensic  evidence  that 

he  gave  a  file  called  Iraq  events  or  a  file  titled 
similarly? 

A.  No,  sir. 

Q.  Okay.     Did  you  have  any  forensic  evidence  of 

him  having  sent  a  cable  having  to  do  with  Iceland  to 
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WiklLeaks? 

A.  No,   sir,  beyond  the  discussion  in  the  chat. 

Q.  Only  the  discussion  in  the  chat.     Okay.  And 

what  about  Guantanamo  Bay  detainee  assessment  briefs? 

A.  Again,   sir,  beyond  the  chat,   no  direct 

contact . 

Q.  Okay.     So  in  that  chat  my  client  talked  about 

the  SigActs,  he  talked  about  a  single  Department  of  State 
cable,  correct? 

A.  Specifically  the  one,  yes,  sir. 

Q.  Reykjavik? 

A.  Yes,  sir. 

Q.  And  he  also  talked  about  detainee  assessment 

briefs . 

MR.  MORROW:     Objection,   Your  Honor.  The 
chats  are  not  the  SigActs . 

THE  COURT:     Captain  Tooman. 

MR.   TOOMAN:     Mr.   Johnson  did  the  — 

THE  WITNESS:      I  don't  recall  the  word  SigAct 
being  in  this  contact,  sir. 
BY  MR.  TOOMAN: 
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Q.  Do  they  talk  about  the  war  logs? 

A.  Not  by  that  term,   no,  sir. 

Q.  What  classified  information  is  referenced  in 

the  chats?  I  believe  you  testified  on  direct  that  there 
was  a  reference  to  Iraq  and  Afghanistan. 

A.  Yes,  sir. 

Q.  What  was  that  reference? 

A.  I'd  have  to  refer  to  specifics,  sir. 

Q.  Please  do. 

A.  Sir,   we  have  arrest  information  related  to 

Tigris  or  Tigris,   that  would  be  in  that  area. 
Q .  Okay . 

A.  Specifically,   sir,  we  have  other  references  to 

Afghanistan.     I'm  not  sure  specifically  what  you're 
looking  for. 

Q.  Okay.     So  there  are  no  references  to  the 

SigActs  in  those  chats? 

A.  There's  no  reference  to  that  term,  sir. 

Q.  Okay.      Is  there  any  reference  to  the  Farah 

video  in  those  chats? 

A.  I  don't  recall. 
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No,    sir,    I  don't  believe  so. 
Q.  Is  there  any  reference  to  the  Granahi  air 

strike  in  that  chats?     Same  thing,  two  different  names. 

A.  I  don't  recall  that  being  in  here,   sir.     I  can 

review  it . 

Q.  Please  do. 

THE  COURT:     Captain  Tooman,   is  this  going  to 
have  a  point?     I  can  read  the  chats. 

MR.   TOOMAN:     Yes,   ma'am,   the  point  is  that 
they're  not  in  there,   and  we've  also  asked  Mr.  Johnson 
what  the  dates  are  of  those  chats. 

THE  WITNESS:     They  are  in  March  2010. 
BY  MR.  TOOMAN: 

Q.  Specifically,   what's  the  range,   is  the  range 

of  5  March  to  18  March? 

A.  5  March  to  —  did  we  have  18  March?     Yes,  sir. 

MR.   TOOMAN:     I'll  retrieve  that  exhibit. 
(INAUDIBLE) . 
THE  WITNESS:      No,  sir. 

MR.   TOOMAN:     I'll  retrieve  prosecution 

exhibit  123. 
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BY  MR.  TOOMAN: 


Q.  Now,   you  spoke  on  direct  about  volume  mounting 

data,  correct? 

A.  Uh-huh.     Yes,  sir. 

Q .  And  that ' s  evidence  of  a  CD  being  burned? 

A.  CD,  other  removable,   some  media  of  some  sort. 

Q.  So  it  could  be  a  flash  drive? 

A.  It  could  be,  yes,  sir. 

Q.  A  SD  card? 

A.  Yes,  sir. 

Q.  External  hard  drive? 

A.  Yes,  sir. 

Q.  In  some  fashion,   data  is  being  transferred 

from  the  Macintosh  to  another  medium? 
A.  Yes,  sir. 

Q.  We'd  retrieve  prosecution  exhibit  127,  please. 

Permission  to  publish,  ma'am? 

THE  COURT:     Go  ahead. 
Q.  Mr.   Johnson,    can  you  see  that  okay? 

A.  Yes,  sir. 

Q.  I'd  like  to  focus  your  attention  on  line  49. 
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What  does  that  line  tell  you? 

A.  That  would  indicate  that  a  file  potentially 

named  Far ah  dot  zip  may  have  come  from  a  volxome  attached 
to  this  machine  using  the  name  of  100411  underscore  918 
or,   excuse  me,   0918  —  0918. 

Q.  Okay.     And  what  the  name  of  that  voliome 

suggests  is  that  that  file,  Farah  dot  zip,  was  put  on 
another  medium  on  April  11,   2010,  correct? 

A.  April  11?     Yes,  sir. 

Q.  And  at  0918  in  the  morning? 

A.  Yes,   sir.     Depending  on  the  timeframe. 

Q.  Now,   you're  not  able  to  tell  what  is  actually 

in  that  file,   can  you? 

A.  No,  sir. 

Q.  You  were  unable  to  recover  that? 

A.  No,   sir,   we  were  not. 

Q.  What  is  a  zip  file,  Mr.  Johnson? 

A.  A  zip  is  an  archive,   compressed  or  an 

archiving  function . 

Q.  Typically  why  would  one  use  that  sort  of  file? 

A.  To  have  additional  files,  to  consolidate  one 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/12/13  Morning  Session 


65 


file  or  multiple  into  a  single  file  that  can  be  easily 
moved  around,  transferred,  stored. 

Q.  Okay.     And  you  would  agree  with  me,   I  think, 

that  another  use  of  a  zip  file  is  to  compress?     If  you 
have  big  files,   you  can  compress  them  into  one  using  the 
zip  function,  correct? 

A.  Yes,  sir. 

Q.  So  you  would  agree  with  me  that  it's  possible 

that  inside  that  file  are  documents  that  take  up  a  lot  of 
space? 

A.  Yes,  sir. 

Q.  Or  files  that  take  up  a  lot  of  space? 

A.  Yes,  sir. 

Q.  Removing  prosecution  exhibit  127  from  the 

projector  and  returning  it  to  court  reporter. 

I'd  like  to  retrieve  prosecution  exhibit  41. 
Permission  to  publish,  ma'am? 
THE  COURT:  Proceed. 
Q.  You  spoke  about  this  email  on  direct.     This  is 

an  email  between  my  client  and  a  person  named  Eric 
Schmiedel,  correct? 
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A.  Yes,  sir. 

Q.  Now,   within  this  video  there's  classified 

information  that's  discussed? 

A.  I'm  sorry.     Within  the  video? 

Q.  I'm  sorry.     Within  this  email. 

A.  I  couldn't  tell  you  whether  the  content  of 

this  email  is  classified. 

Q.  Okay.     Does  it  reference  what  you  understand 

to  be  classified  material? 

A.  State  department  cables,  yes,  sir. 

Q.  It  also  references  an  entire  database  of 

events  for  the  Iraq  war? 

A.  Yes,  sir. 

Q.  So  that  would  be  the  SigActs,   is  that  what  you 

understand  that  to  be? 

A.  I  don't  know  what  those  incident  reports  are, 

sir . 

Q.  Okay.     It  also  talked  about  the  Apache  video, 

is  that  correct,   collateral  murder? 
A.  Yes,  sir. 

Q .  Move  it  up  here  a  little  bit . 
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A.  Sorry,    sir.     The  screen's  a  little  blurry. 

Yes,   sir.     Dovm  in  section  three. 
Q.  Dovm  in  section  three  there's  discussion  of 

the  Apache  video? 

A.  Yes,   sir.     Well,   collateral  murder. 

Q.  Collateral  murder? 

A.  Yes,  sir. 

Q.  Do  you  understand  those  videos  to  be  the  same 

thing? 

A.  Yes,  sir. 

Q .  I ' ve  removed  the  email  from  the  overhead . 

Mr.   Johnson,   you'd  agree  with  me  there's  no 
other  docToments  or  videos  referenced  in  that  email, 
correct? 

A.  I  don't  recall  seeing  anything  else  in  there, 

sir . 

Q.  Okay.     I'm  going  to  hand  this  to  the  witness. 

Mr.   Johnson,   is  there  any  reference  to  a 
Farah  video  in  that  email? 
A.  No,  sir. 

Q.  What  are  the  dates  of  that  email  chain? 
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A.  Can  you  be  more  specific,  sir? 

Q.  Sure.     My  understanding  of  that  document  is 

it's  a  chain  of  emails  between  PFC  Manning  and  Eric 
Schmiedel .     When  was  the  first  email  sent? 

A.  May  19. 

Q.  And  when  was  the  last  email  sent,  the  most 

recent  one? 

A.  May  20. 

Q.  Thank  you,   Mr.  Johnson. 

Mr.   Johnson,   you  spoke  in  your  examination  of 
the  unallocated  clusters,  correct? 
A.  Yes,  sir. 

Q.  And  what  we  understand  the  unallocated 

clusters  to  be  are  basically  that's  where,  when  you 
delete  something,  that's  where  it  goes? 

A.  Where  it  remains,   yes,  sir. 

Q.  And  it  would  remain  there  until  it  was 

overwritten,  correct? 

A.  That's  correct. 

Q.  And  if  it's  overwritten,   then  it's  pretty  much 

gone  forever? 
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A.  Not  pretty  much,    sir.     It  is  gone. 

Q.  It  is  gone.  Okay. 

Now,   within  the  unallocated  clusters,  you 
can't  associate  a  date  with  something,  correct? 
A.  Not  directly,   sir,  no. 

Q.  So  you  don't  know  when  the  file  was  deleted? 

A.  No,  sir. 

Q.  Can't  associate  a  time  either? 

A.  No,  sir. 

Q.  All  you  know  is  that  this  file  is  now  in  the 

unallocated  clusters? 

A.  The  contents  are,  yes,  sir. 

Q .  Sorry . 

A.  The  content.     It  may  be  a  fragment  of  a  file. 

Q.  Okay.     So  it  could  be  a  partial  file? 

A.  Correct. 

Q.  So,   for  example,   if  it  were  a  picture,  you 

might  only  see  half  a  picture? 
A.  Correct. 

Q.  Now,   when  you  were  searching  the  unallocated 


clusters,   you  were  again  searching  for  any  sort  of  clues. 
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correct? 

A.  Yes,  sir. 

Q.  And  one  of  the  things  you  were  searching  for 

were  any  references  to  WikiLeaks? 
A .  Sure . 

Q.  Because  WikiLeaks  was  implicated  in  this 

investigation,   you  wanted  to  find  every  instance  where 
WikiLeaks  was  talked  about? 

A.  Sure. 

Q.  Okay.     You  found  several,   didn't  you? 

A.  Yes,  sir. 

Q.  You  found  over  a  hundred  instances  of  the 

WikiLeaks  page  in  the  unallocated  clusters? 

A.  I'd  have  to  refer  to  my  report.     It  sounds 

reasonable . 

Q.  Okay.     You  found  some  JPEGs,   a  JPEG  being  a 

picture  file? 

A.  Yes,    sir,    (INAUDIBLE) .      Yes,  sir. 

Q.  You  didn't  find  any  evidence  of  what's  known 

as  a  WikiLeaks  most  wanted  list  in  the  unallocated 
clusters,   did  you? 
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A.  No,  sir. 

Q .  And  you  dldn ' t  find  that  in  the  allocated 

clusters  either? 

A.  No,  sir. 

Q.  So  on  PFC  Manning's  computer,  whether  in  the 

allocated  space  or  in  the  unallocated  space,  no  reference 
to  the  WikiLeaks  most  wanted  list? 

A.  No,  sir. 

Q .  That ' s  something  you  certainly  would  have 

noted  had  you  found  it? 
A.  Yes,  sir. 

Q.  You  also  were  able  to  look  at  or  recover  other 

websites  that  PFC  Manning  would  have  visited? 
A.  Yes,  sir. 

Q.  None  of  those  websites  were  associated  with 

terrorism? 

A.  No,  sir. 

Q.  They  weren't  associated  with  a  hatred  of 

America  or  anti— American  beliefs? 
A.  No,  sir. 

Q.  Now,   sitting  in  the  unallocated  clusters  you 
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found  several  references  to  the  WlklLeaks  submission 
page,  correct? 

A.  Yes,  sir. 

Q.  And,   again,   you  can't  associate  a  date  or  a 

time  with  those  pages,   is  that  correct? 

A.  I  cannot  determine  the  dates  and  times  of  the 

page  we  have  fragments.  However,  there  do  appear  to  be 
dates  and  times  in  the  vicinity  of  those  that  appear  to 
be  possibly  content  on  that  page . 

Q .  Sure .     So  you  don ' t  know  when  that  page  ended 

up  in  the  unallocated  clusters,  but  when  you  look  at  the 
page  itself  there  are  some  clues? 

A.  There  are  clues. 

Q.  To  the  date? 

A.  Yes,  sir. 

Q.  And  on  the  submission  page  you  see  what 

appears  to  be  submissions  by  PFC  Manning  to  the  WikiLeaks 
web  page  on  a  couple  different  dates,  correct? 

A.  I  believe  so,    sir.      I'd  have  to  verify  that. 

Q.  Okay.     One  of  those  days  was  the  11th  of 

April,  2010? 
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A. 


I  don't  remember  specific  dates,   sir.  It 


sounds  reasonable . 


Q. 


Is  that  about  what  you  remember? 


A. 


It  was  April,  sir. 


Again,   that  sounds  right. 


but  I  don't  remember  specifically.     I  need  to  refer. 


MR .   TOOMAN :     Your  Honor ,  Mr .   Johnson ' s  report 


is,  his  report  of  PFC  Manning's  Macintosh  computer  is  a 
classified  document.     It  hasn't  been  marked.     We  have  it 
here.     If  we  could  take  a  brief  recess  we  can  get  that 
docToment,   have  it  marked  so  Mr.   Johnson  can  refer  to  it. 


THE  COURT:  In  the  panel  box? 
MR.   TOOMAN:     Yes,  ma'am.     Of  course. 

THE  COURT:  How  long  do  you  need? 
MR.   TOOMAN:     Five  minutes. 

THE  COURT:  All  right.     Why  don't  we  make  it 


the  regular  ten.     We'll  reconvene  at  11:15. 
(BRIEF  RECESS.) 

THE  COURT:     Let  the  record  reflect  all 
parties  present  when  the  court  recessed  are  again  present 
in  court.     The  witness  is  in  the  witness  box. 


Q. 


Okay .     Just  a  moment ,  please . 
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Captain  Tooman,   are  you  ready? 

MR.   TOOMAN:     Yes,  ma'am.     For  the  record,  Mr. 
Johnson  has  defendant ' s  exhibit  Juliette  for 
identification . 

THE  COURT:     I  thought  you  were  getting  a 
different  exhibit .     Juliette  is  what  you  were 
referencing? 

MR.   TOOMAN:     Yes,  ma'am. 
BY  MR.  TOOMAN: 

Q.  Mr.   Johnson,   if  you  could  please  take  a  look 

at  that  exhibit  and  just  tell  us  what  it  is . 
A.  This  is  a  copy  of  my  forensic  — 

THE  COURT:     Okay.     Now  you're  sitting  way  far 
away  from  me  and  I'm  going  to  have  a  real  difficult  time 
hearing  you. 

THE  WITNESS :     Sorry . 

THE  COURT:     Can  you  say  what  that  was  again? 

THE  WITNESS:     This  is  a  copy  of  my  forensic 
report  from  his  Mac  computer. 

THE  COURT:     Thank  you. 
BY  MR.  TOOMAN: 
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Q.  How  do  you  know  that  that's  your  forensic 

report? 

A.  It  is  on  our  structure,   it  has  my  signature 

copy  attached  to  it .     It  appears  to  be  complete . 

Q.  How  did  you  go  about  creating  that  report,  Mr. 

Johnson? 

A.  I'm  sorry,   sir.     Could  you  be  more  specific? 

Q.  Sure.     What  was  the  process  you  followed  when 

you  created  that  report? 

A.  It  was  derived  during  the  course  of  my 

investigation .     It  includes  findings  and  is  ultimately  a 
word  document  converted  into  a  WPDF  format . 

Q.  Now,  Agent  Johnson,  does  that  docxoment,  I 

asked  you  a  question  before  we  recessed,  about 
STjbmissions  to  WikiLeaks . 

A.  Yes,  sir. 

Q.  And  would  you  agree  with  me  that  there  was 

evidence  in  unallocated  clusters  of  a  submission  to 
WikiLeaks  on  11  April  2010? 

A.  I'll  refer  to  the  report,   sir,   for  the  date. 

Q .  Okay . 
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A.  That  would  be  April  10,    2010,  sir. 

Q.  Okay.     So  siibmission,  what  appears  to  be  a 

STibmission  to  WikiLeaks  on  April  10? 
A.  Yes,  sir. 

Q.  Are  there  any  other  days  where  there  appear  to 

be  submissions  to  WikiLeaks  in  April  2010? 
A.  April  11. 

Q .  Okay . 

A.  And  April  12 . 

Q.  Okay.     Are  there  any  other,   did  you  recover 

any  other  evidence  in  the  unallocated  clusters  of 
WikiLeaks  submissions? 

A.  I  don't  believe  so,   sir,  no. 

Q.  You  can  head  back  to  the  witness  stand.  I've 

retrieved  the  exhibit . 

THE  COURT:     That's  defendant's  exhibit 
Juliette  for  identification,  right? 

MR.   TOOMAN:     Yes.     And  actually  we  would 
offer  this  as  defendant's  exhibit  Juliette  in  the  record. 

MR .  MORROW :     Ob j  ect ion . 

THE  COURT:     What's  your  objection? 
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MR .   MORROW :     Hearsay . 

MR.  TOOMAN:     These  are  the  statements  of  the 
witness .     He  authenticated  it . 

MR.  MORROW:     They  would  be  out  of  court 
statements  offered  to  prove  the  truth  of  the  matter 
asserted. 

THE  COURT:     All  right.  Sustained. 

MR.   TOOMAN:     Would  offer  it  under  803.6, 
created  in  the  ordinary  course  of  Mr .   Johnson ' s  business . 

THE  COURT :     Government . 

MR.  MORROW:     One  moment.   Your  Honor. 

Your  Honor,   I  don't  believe  the  defense  has 
laid  a  foundation  for  the  business  record  exception. 

THE  COURT:     Well,   that's  true.     Want  to 
continue  on  with  this  witness? 

MR.   TOOMAN:     Yes,  ma'am. 
BY  MR.  TOOMAN: 

Q.  Mr.   Johnson,   can  you  explain  for  the  court 

what  that  document  was  and  why  it  was  created? 

A.  It's  the  forensic  report  that  I  developed 

during  the  course  of  my  investigation. 
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Q .  How  many  of  those  would  you  say  you ' ve  created 

in  your  career? 


A. 

I  do  not  know,   sir.  A 

niomber . 

Q. 

Would  it  be  a  lot? 

A. 

A  fair  number,  sir. 

Q. 

Hundreds? 

A. 

Probably  not,  sir. 

Q. 

Is  that  something  that 

you  create  every  time 

you  do  a  forensic  examination  of  a  computer  or  some  piece 
of  digital  media? 

A.  Not  necessarily,   sir,  no. 

Q.  Okay.     Did  you  do  that  as  part  of  your  duties 

with  respect  to  this  investigation? 

A.  Yes,  sir. 

MR .   TOOMAN :     One  moment ,  please . 

Q.  Mr.   Johnson,   are  you  required  to  make  that 

report  as  part  of  your  —  as  part  of  this  investigation? 

A.  Yes,  sir. 

Q.  What  did  you  do  with  it  once  you  created  it? 

Where  did  you  store  it? 

A.  Could  you  be  more  specific,  sir? 
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Q.  How  did  you  store  that  docioment  once  you 

created  it? 

A .  It '  s  a  digital  dociament  stored  on  our  closed 

and  classified  systems . 

Q.  Is  that  what  you  all  do  with  every  forensic 

examination  report  that  you  create? 

A.  Yes,  they  would  be  on  the  appropriate  systems. 

MR.   TOOMAN:     Your  Honor,  we  would  re— offer 
defendant ' s  exhibit  Juliette  under  the  business  records . 

THE  COURT :     May  I  see  defendant ' s  exhibit 

Juliette? 

MR.   TOOMAN:     Yes,  ma'am. 

THE  COURT:     Is  this  report  exclusively  your 
examination  of  that  computer?     Did  you  talk  to  anybody 
else?     Is  there,   are  there  any  statements  from  other 
people  in  this  report? 

THE  WITNESS:     Yes,  ma'am. 

THE  COURT:     There  are  statements  from  other 
people  in  this  report . 

THE  WITNESS:     Statements,  ma'am? 

THE  COURT:     Did  you  interview  anybody? 
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THE  WITNESS:     No,    sir.     No,   ma'am.  Pardon 

me . 

THE  COURT :     Government . 
MR.   FEIN:     Ma'am,   if  I  may. 
THE  COURT:  Yes. 

MR.  FEIN:     A  few  issues.   Your  Honor.  First, 
under  803.6,   this  docxoment  clearly  was  created 
specifically  for  this  court— martial,   not  necessarily  in 
the  regularly  conducted  business  of  Mr.   Johnson.  It's 
also  CTomulative  with  his  testimony. 

If  the  defense  counsel  wants  to  refresh  his 
recollection  or  use  this  as  past  recollection  recorded, 
the  witness  can  testify  off  of  the  docxoment,  but  not  in 
lieu  of  or  the  document  siabstituting  for  the  actual 
in— court  testimony  and  then  while  they're  here.     So  it's 
not  only  hearsay,   not  falling  under  803.6,  but  it's  also 
cumulative  to  his  testimony  of  an  in-court  witness . 

THE  COURT:     All  right.     Well,  the  cxomulative 
I'm  going  to  overrule. 

The  MRE  803.6,   is  this  a  forensic  laboratory 

report? 
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THE  WITNESS:     Yes,   ma'am,   you  could  treat  it 
as  that,  yes,   sir.     Yes,  ma'am. 

THE  COURT :     Government . 

MR.  FEIN:     Yes,  ma'am.     Although  it  is  a 
forensic  laboratory  report,   again,   it  was  made  solely  for 
the  purposes  of  this  litigation. 

THE  COURT:     I'm  going  to  overrule  the 
objection.     It's  made  as  part  of  the  regular  course, 
regularly  conducted  business  activity  of  this  entity. 
Defendant's  exhibit  Juliette  is  admitted. 
BY  MR.  TOOMAN: 

Q.  Mr.   Johnson,   were  you  able  to  tell  —  again, 

we ' re  still  talking  about  the  WikiLeaks  sxibmissions  from 
the  unallocated  clusters .     Were  you  able  to  tell  if  those 
STjbmissions  were  successful?     Was  the  submission 
completed? 

A.  There's  no  mention  of  the  words  upload 

complete  that  I  would  interpret  as  a  success . 

Q.  Was  there  any  evidence  that  WikiLeaks  actually 

got  it? 

A.  I  couldn't  say,   sir.     That  would  not  be 
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available  on  this  computer. 

Q.  In  the  course  of  your  investigation,   did  you 

uncover  any  evidence  of  WikiLeaks  releasing  anything 
related  to  Farah? 

A.  I  did  not,  no. 

Q.  Now,  you  also  did  a  search  for,   on  the 

computer  for  Farah,  correct? 

A.  Yes,   sir,   I  believe  so. 

Q.  And  you  found  several  files,   again,   in  the 

unallocated  clusters,   and  they  were  in  the  location  users 
slash  BManning  slash  desktop  slash  Farah  slash  Farah. 

A.  That  was  references  to  it.     I  don't  believe 

those  were  actual  files  we  found. 

Q.  What  was  in  there? 

A.  I  don't  recall,   sir.     I  don't  recall  the 

specific  names,  sir. 

Q.  Okay.     I'm  going  to  hand  the  witness 

defendant's  exhibit  Juliette.     If  you  would  please  move 
to  the  panel  box. 

MR.  FEIN:     Your  Honor,   objection.     If  it's 
already  admitted,  this  would  be  cxomulative. 
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THE  COURT:     Major  Fein,   the  government  has 
been  doing  that  throughout  the  trial . 

MR.  FEIN:     Yes,  ma'am. 
BY  MR.  TOOMAN: 

Q.  I  believe  this  would  be  on  the  same  page  you 

were  just  looking  at,  Mr.  Johnson. 

A.  Thank  you,   sir.     Which  I  have  to  find  again. 

Q.  I  believe  it's  page  67  or  page  66. 

A.  Thank  you,  sir. 

Can  you  repeat  your  question,  sir? 

Q.  Sure.     You  would  agree  with  me  that  you  found 

references  to  Farah  in  a  location  that  was  users  slash 
BManning  slash  desktop  slash  Farah  slash  Farah? 

A.  The  slash  Farah,   sir,   the  rest  of  that  is  the 

file  name .     Users  slash  BManning  slash  desktop  slash 
Farah . 

Q.  Okay.     Just  one  Farah  in  that  location? 

A.  Yes,  sir. 

Q.  And  in  that  file  you  found  seven  files  titled 

Farah,  correct? 

A.  Yes,   sir,   I  believe  so. 
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Q.  And  they  were  titled  Farah  dot  part  one  and 

then  they  all  have  that  name,   correct,  with  the  — 
A .  That ' s  correct . 

Q.  So  Farah  dot  part  1  through  part  7? 

A.  Yes,   sir.     With  dot  RAR  on  the  end  of  it. 

Q.  With  dot  RAR.  Okay. 

And  you  don't  know  when  those  docxoments 
arrived  in  that  location,   do  you? 
A.  No,  sir. 

Q.  But  you  could  say  that  those  docxaments  got 

there  after  31  January,  correct? 

A.  In  reference  to  these  documents,  yes,  sir. 

Q.  Well,  the  unallocated  space  was  wiped  on  31 

January,  correct? 

A.  Yes,  sir. 

Q.  So  anything  that  is  in  the  unallocated 

clusters  must  have  arrived  there  after  31  January,  right? 
A.  Yes,  sir. 

Q.  Now,   you  also  found  several  documents  related 

to  Farah  that  in  your  examination  were  identical  to  files 
found  on  CENTCOM  servers,  correct? 
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A.  Could  you  be  more  specific,  sir? 

Q.  Sure.     You  found  54  pictures.     And  before  you 

refer  to  the  document,   if  you  can  answer  from  your 
memory,   and  if  not,   then  refer  to  the  document.     Do  you 
recall  finding  54  pictures  in  the  unallocated  space  that 
had  identical  hash  values  as  pictures  found  on  the 
CENTCOM  server? 

A.  Yes,   sir,   I  believe  so. 

Q.  You  also  found  one  video  that  has  the 

identical  hash  value  to  a  video  found  on  the  Farah 
server,  correct? 

A.  I  believe  so.     I  don't  recall,  sir. 

Q.  Okay.     Well,  please  look  and  verify  that. 

A.  Yes,  sir. 

THE  COURT:     What  was  the  question  again,  the 
last  question? 

Q.  Yes,  ma'am. 

Mr.   Johnson,   in  the  unallocated  clusters  you 
found  a  video  that  had  the  same  hash  value  as  a  video 
that  you  found  on  the  CENTCOM  server,  correct? 

A.  They  were  contained  within  a  recovered  RAR 
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file,   yes,  sir. 

Q.  And  that  recovered  RAR  file  was  associated 

with  Farah,  correct? 

A.  Yes,  sir. 

Q.  Okay.     So  you  would  assume  that  that  video 

file  has  something  to  do  with  Farah? 
A.  Yes,  sir. 

Q.  Particularly  since  the  hash  value  of  the  video 

on  PFC  Manning's  computer  matched  the  hash  value  of  a 
video  that  you  found  within  the  Farah  folders  on  the 
CENTCOM  servers? 

A.  Agent  Shaver  found  all  the  files  on  CENTCOM. 

We  compared  them. 

Q.  And  you  didn't  make  note  of  the  actual  file 

type,   did  you? 

A.  File  type?    No,  sir. 

Q.  Just  it's  a  video  file? 

A.  A  video  file,  yes,  sir. 

Q.  And  you  agree  with  me  that  there  are  multiple 

types  of  formats  that  video  files  could  be  in,  correct? 
A.  Yes,  sir. 
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Q.  There's  WMV,   that's  a  type  of  movie  file? 

A.  Yes,  sir. 

Q.  What  are  some  other  ones? 

A.  MP4,   DVI .     There's  a  large  nxjmber,  sir. 

Q.  And  you  all  didn't  know  what  type  of  file  it 

was? 

A.  No,   sir,   I  did  not. 

Q.  And  you  didn't  make  a  note  of  the  file  name  on 

the  Farah  server  that  the  file  on  PFC  Manning's  computer 
matched,  correct? 

A.  No,   sir,   I  did  not. 

Q.  Just  one  of  the  videos  on  the  CENTCOM  server 

matched  a  video  in  PFC  Manning's  unallocated  clusters? 
A.  Yes,  sir. 

Q.  So  we  don't  know  what  video  that  is? 

A.  No,   sir,   I  do  not  recall. 

Q.  But  you  would  agree  with  me  that  that  video 

must  have  arrived  in  the  unallocated  clusters  after  31 
January? 

A.  Yes,   they  were  filed  in  there  after  31 

January . 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/12/13  Morning  Session 

88 


Q.  And  you  didn't  find  any  references  to  the 

Farah  video  in  the  allocated  clusters? 

A.  No,   sir,   I  don't  believe  so. 

Q .  Okay .     I'm  going  to  retrieve  defendant ' s 


exhibit  Juliette.     And  Mr.  Johnson,   can  you  retake  the 
witness  chair? 

Mr.   Johnson,   throughout  your  investigation 
you  talked  about  you  looked  at  everything  on  PFC 


Manning's  computer,  right? 

A.  Define  everything,  sir. 

Q.  You  looked  at  every  bit  and  byte  on  that 

computer,   and  you  looked  at  it  for  evidence? 

A.  I've  looked  at  the  contents,   sir.     I  can't  say 

we ' ve  examined  every  bit  and  byte . 

Q.  Okay.     Well,   you  had  a  forensic  image  of  it 

which  is  an  exact  copy,  correct? 

A.  Yes,  sir. 

Q.  And  within  that  exact  copy  you  conducted 

searches? 

A.  Yes,  sir. 

Q.  And  those  searches  looked  at  the  entire 
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computer? 
A. 

Q. 
A. 

Q. 

correct? 
A. 

Q. 
A. 

Q. 


Yes,  sir. 

The  allocated  space  and  the  unallocated  space? 
Yes,  sir. 

That  included  chats  which  we've  talked  about. 


Yes,  sir. 

That  included  emails? 
Yes,  sir. 

You  saw  no  references  on  PFC  Manning's 
personal  Macintosh  to  Jason  Katz,   did  you? 

A.  No,   sir,   I  did  not  identify  Katz. 

Q.  There  were  no  emails  between  PFC  Manning  and 

an  individual  named  Jason  Katz? 

A.  No,   sir,   I  don't  believe  so. 

Q.  No  chats? 

A.  No,  sir. 

Q.  No  websites  that  you  associated  with  Jason 

A.  No,  sir. 

Q.  No  connection  whatsoever  between  PFC  Manning 


Katz? 
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and  Jason  Katz? 

A.  Not  that  I  identified,  sir. 

Q.  Okay.     You  also  didn't  find  any  financial 

transactions  that  would  have  suggested  to  you  that  PFC 
Manning  was  paid  for  anything  he  gave  to  WikiLeaks? 

A.  No,  sir. 

Q.  There  were  no  large  stuns  of  money  that  were 

transferred  to  PFC  Manning? 
A.  No,  sir. 

Q.  You  spoke  on  direct  about  the  global  address 

list,  correct? 

A.  Yes,  sir. 

Q.  I  want  to  retrieve  prosecution  exhibit  122, 

please . 

Ma'am,  permission  to  publish. 

THE  COURT:     Go  ahead. 
Q.  Now,  Mr.   Johnson,   you  testified  that  this  was 

what  you  would  call  a  tasker,  correct? 
A.  Yes,  sir. 

Q.  Could  you  tell  what  format  this  document  was 

in? 
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A.  It's  raw  text,  sir. 

Q.  A  text  file.     So  that  would  have  been 

something  —  could  you  tell  how  it  got  on  the  computer? 
A.  No,  sir. 

Q.  But  this  is  the  sort  of  thing,   so  there's  no 

evidence  that  would  suggest  someone  sent  this  to  PFC 
Manning? 

A.  I  cannot  determine  that,  sir. 

Q .  Okay .     So  you  would  agree  with  me  that  it ' s 

quite  possible  that  this  is  a  docxoment  PFC  Manning 
created  himself? 

A.  It's  possible,  sir. 

Q.  And  are  you  familiar  with  the  format  of  that 

document? 

A.  Can  you  be  more  specific,  sir? 

Q.  Does  that  look  like  a  military  sort  of  format 

for  a  document? 

A.  It  looks  to  me  to  be  similar,  yes,   I'll  say 

similar . 

Q.  Okay.     Now,   you  would  agree  with  me  that  the 

objective  portion  of  this  is  blank? 
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A. 

Yes,  sir. 

Q. 

It  doesn't  say  send  to  WikiLeaks? 

A. 

No,  sir. 

Q. 

It  doesn't  say  anything? 

A. 

Doesn't  say  anything. 

Q. 

Returning  prosecution  exhibit  122 . 

Now,   we  talked  about  the  WikiLeaks  submission 
pages  and  the  only  WikiLeaks  sxibmission  pages  you  found 
had  to  do  with  Farah,  correct? 

A.  With  the  Farah  dot  RAR  files,  yes,  sir. 

Q.  Right.     There  were  no  WikiLeaks  sxabmission 

pages  that  suggested  that  PFC  Manning  sent  something  to 
WikiLeaks? 

A.  No,  sir. 

Q.  And  in  fact,   you  found  the  global  address  list 

or  what  appeared  to  be  the  global  address  list  in  the 
unallocated  clusters? 

A.  Yes,  sir. 

Q.  And  that  means  it  was  deleted? 

A.  Yes,   sir,  deleted  content.     It's  there 

somehow. 
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Q.  Okay.     It  had  to  have  been  —  is  it  possible 

to  put  something  on  unallocated  clusters? 

A.  Possible,  but  it  would  require  extraordinary 

work . 

Q.  Okay.     In  all  likelihood  it  was  something  that 

was  on  the  computer  in  the  allocated  space  and  then  the 
user  pushed  delete? 

A.  Yes,  sir. 

Q.  Okay.     Now,   you're  a  computer  expert.     Do  you 

ever  challenge  yourself  with  things  related  to  computers 
just  to  see  if  you  can  do  it? 

A.  Can  you  be  specific? 

Q.  Yeah.     Have  you  ever  just  been  at  a  computer 

and  thought  I  wonder  if  I  could  do  this,   and  then  you 
tried  to  do  it? 

A.  Yes,  sir. 

Q.  Are  you  aware  that  at  the  time  the  global 

address  list  was  downloaded  my  client  was  no  longer 
working  as  an  intelligence  analyst,   he  was  working  in  a 
supply  room? 

A.  I'm  not  familiar  with  the  timeframe  on  that. 
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sir . 

Q.  Okay.     Do  you  think  it's  possible  that  if  PFC 

Manning  were  in  a  supply  room  he  might  — 

THE  COURT:     Overruled.     I'm  sorry.     I  mean 
sustained.     No.     That's  speculation. 

Q.  I'm  going  to  continue  talking  a  little  bit 

about  the  GAL.     You  said  it  appeared  to  be  a  global 
address  list,  correct? 

A.  Yes,  sir. 

Q.  You  would  agree  with  me  that  there  is  someone 

who  controls  the  global  address  list? 
A.  Can  you  specify,  sir? 

Q .  Sure .     There  would  be  someone  within  DOD  who 

could  tell  you  exactly  who  was  on  the  global  address 
list,  correct? 

A.  At  some  particular  point  in  time,   yes,  sir. 

Q.  Sure.     You  could  go  to  someone  and  you  could 

say,  hey,   as  of  June  11,  what  is  the  global  address  list? 

A.  I  don't  know  if  they  could  give  you  a  specific 

point  in  time,  but  yes. 

Q.  Okay.     Someone  could  print  it  out  and  say  here 
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are  the  names  that  are  the  global  address  list? 
A.  Yes,  sir. 

Q.  Okay.     Did  you  all  do  that  as  part  of  your 

investigation,   ask  someone  for  the  actual  global  address 
list? 

A.  I  do  not,   sir,  that  would  be  outside  the  scope 

of  f orensics . 

Q.  So  you  all  didn't  compare  the  global  address 

list  that  you  found  or  what  appeared  to  be  a  global 
address  list  in  the  unallocated  space,  you  never  compared 
that  to  an  actual  global  address  list? 

A.  I  did  not,   no,  sir. 

Q.  Okay.     Mr.  Johnson,   would  you  agree  with  me 

that  Iraq  is  a  very  challenging  environment  for 
electronics? 


A. 

Yes,  sir. 

Q. 

It's  very  hot? 

A. 

Yes,  sir. 

Q. 

Very  dusty? 

A. 

Yes,  sir. 

Q. 

Sandy? 
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A.  Yes,  sir. 

Q .  It's  difficult  for  a  computer? 

A.  Yes,  sir. 

Q .  So  when  one ' s  having  computer  problems 

something  that  they  can  do  to  alleviate  those  problems  is 
to  wipe  the  machine,   correct,    just  start  over? 

A.  Can  you  be  more  specific,  sir? 

Q.  Sure.     If  you're  having  performance  problems 

with  your  computer,   one  of  the  things  that  you  could  do 
would  be  I'm  just  going  to  wipe  this,   I'm  going  to  start 
over? 

A.  Sure.     But  that  would  not  have  anything  to  do 

with  physical  environment . 

Q.  Okay.     But  it  could  correct  some  of  the 

problems  that  your  computer  was  having? 

A.  Possibly,  sir. 

Q.  And  there  are  a  lot  of  reasons  why  people  wipe 

their  machines,  correct? 
A.  Yes,  sir. 

Q.  You  testified  that  PFC  Manning  reinstalled  his 

operating  system  on  25  January  2010? 
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A.  Yes,  sir. 

Q.  He  wiped  the  unallocated  space  or  cleaned  the 

unallocated  space  on  31  January  2010? 
A.  Yes,  sir. 

Q.  Now,   PFC  Manning  is  charged  with  giving  the 


Apache  air  strike  video  to  WikiLeaks,  he's  charged  with 
having  done  that  between  15  February  and  April  5,  2010. 
Is  there  any  evidence  that  PFC  Manning  wiped  his  computer 
in  that  time? 

A.  I  don't  recall,   sir.     I  don't  believe  so. 

Q.  PFC  Manning  is  charged  with  giving  SigActs  to 

WikiLeaks.     Is  there  any  evidence  that  he  wiped  his 
machine  in  February  of  2010? 

A.  Again,   sir,   I  don't  recall  a  specific  date, 

but  I  don't  believe  there  was  anything,  no. 

Q.  Okay.     He  didn't  wipe  his  machine  in  April 

2010? 

A.  I  don't  recall.     I'd  need  to  refer  to  the  log 

file,   sir,  but  I  don't  recall  being  there,  no. 

Q.  I  believe  you  testified  that  there  was  only 

one  instance  of  him  wiping  unallocated  space,  right? 
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A.  Yes. 

Q.  And  he  didn't  wipe  it  in  April? 

A.  Again,   I  have  to  refer  to  the  log  to  confirm, 

but  I  don't  recall,   sir,  no. 

Q.  Could  I  have  prosecution  exhibit  125,  please? 

Handing  the  exhibit  to  Mr .  Johnson . 

Mr.   Johnson,   would  you  please  review  those 
logs  and  tell  me  if  PFC  Manning  wiped  his  machine,  if 
there ' s  any  evidence  of  PFC  Manning  wiping  his  machine  in 
February  of  2010? 

A.  Yes,  there  is. 

Q.  What  did  he  do? 

A.  He  erased  his  machine  on  2—11,   2010,  free 

space . 

Q.  And  what's  the  free  space? 

A.  The  unallocated  clusters.     I  do  stand 

corrected. 

THE  COURT:     What  was  the  date  of  that? 
THE  WITNESS:     2-11,  ma'am. 
Q.  Any  other  instances? 

A.  However,   sir,   I  will  have  to  annotate  that  it 
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was  stopped . 

Q.  So  it  was  not  completed? 

A .  That ' s  correct . 

Q.  Any  other  instances? 

A.  No,  sir. 

Q .  Retrieve  the  exhibit .     So  the  one  in  February 

was  stopped,  that  means  that  nothing  was  wiped,  correct? 

A.  Only  the  first,  whatever  was  wiped  in  the 

first  two  minutes,  sir. 

Q.  So  two  minutes.     And  I  think  you  testified  on 

direct  that  when  PFC  Manning  did  a  wipe  before  it  took 
almost  four  hours? 

A.  Three  hours,   something,   yes,  sir. 

Q.  3  hours  and  40  minutes? 

A.  Roughly,   sir,   somewhere  in  that  range. 

Q.  How  much  gets  wiped  in  two  minutes? 

A.  It  will  depend  depending  on  the  operating 

system,  hard  drive .     Very  little  amount . 

Q .  So  there ' s  no  evidence  that  PFC  Manning  wiped 

his  computer  in  any  other  time  in  February? 

A.  I  did  not  observe  any,  no. 
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Q.  Nothing  in  March? 

A.  I  did  not  observe  any  further  entries  in  the 

log,  sir. 

Q.  So  nothing  in  April? 

A.  No,  sir. 

Q.  Nothing  in  May? 

A.  No,  sir. 

MR.   TOOMAN:     No  further  questions.  Thank 
you,   Mr.  Johnson. 

THE  COURT:  Redirect. 

MR.  MORROW:     May  we  have  a  moment.  Your 

Honor? 

THE  COURT:  Yes. 

MR.   MORROW:     Your  Honor,   may  we  have  a  ten 
minute  recess,  please? 

THE  COURT:     Yes,   you  may.     Special  Agent 
Johnson,   once  again,  please  don't  discuss  your  testimony 
or  knowledge  of  the  case  with  anyone  during  the  recess, 
okay? 

THE  WITNESS:     Yes,  ma'am. 

THE  COURT:     Counsel,  may  I  see  you  when  we 
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recess  the  court  for  just  a  brief  second? 


MR.  FEIN:     Yes,  ma'am. 


THE  COURT: 


Court  is  in  recess. 


(BRIEF  RECESS.) 


THE  COURT: 


Court  is  called  to  order. 


Let 


the  record  reflect  all  parties  present  when  the  court 
last  recessed  are  again  present  in  court .     The  witness  is 
on  the  witness  stand.     Captain  Morrow. 


And  I  want  to  begin  by  talking  about  something  Captain 
Tooman  referred  to,   a  WikiLeaks  most  wanted  list. 

I'm  retrieving  prosecution  exhibit  109  for 
identification  and  prosecution  exhibit  110. 

Permission  to  publish  this,  ma'am? 
THE  COURT:  Yes. 
BY  MR.  MORROW: 

Q.  Let's  start  first  with  prosecution  exhibit  109 

for  identification.     Mr.   Johnson,    I'd  just  like  you  to 
read  the  top  of  the  page  there.     What  does  this  say? 

A.  I'm  sorry,   sir.     That's  slightly  out  of  focus 


REDIRECT  EXAMINATION  BY  MR.  MORROW: 


Q. 


Mr.   Johnson,   I  just  have  a  couple  questions. 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/12/13  Morning  Session 

102 

for  me . 


Q. 

Better? 

A. 

As  good  as  it's  going  to  get,  sir. 

Q. 

Well  — 

A. 

I  can  read  that,  sir. 

Q. 

Does  that  help? 

A 

Q. 

What  does  it  say? 

A. 

What  was  the  question  again,  sir? 

Q. 

Just  read  starting  with  the  draft . 

A. 

Draft,  the  most  wanted  leaks  of  2009,  sort. 

Q. 

And  at  the  very  top  of  the  page  what ' s  after 

sort? 

A.  That  heading  line  includes  the  word  WikiLeaks . 

Q .  And  I ' m  going  to  move  to  the  bottom  of  the 

page .     Now,   at  the  very  bottom  with  TTP  colon  slash  slash 
web.     What  does  that,   as  an  examiner,  what  does  that  mean 
when  a  page  has  sort  of  got  that  line  of  information  at 
the  bottom?     What  does  that  indicate  to  you? 

A.  It  would  indicate  to  me  that  this  was  probably 

a  printed  page  from  a  website  and  that  bottom  URL  would 
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be  the  URL  of  the  website  being  printed. 

Q .  Okay .     And  now  let ' s  just  go  up  and  let ' s  look 

at,  do  you  see  a  box  there,  has  a  series  of  niombers,  23 
Sudan,   24,  Syria? 

A.  Yes,  sir. 

Q.  Do  you  see  the  United  States  up  there? 

A.  Yes,  sir. 

Q.  Okay.     I'm  going  to  flip  to  the  section  on  the 

United  States . 

MR.   TOOMAN:     Objection,   Your  Honor. 

Relevance . 

THE  COURT:     Where  are  you  going  with  this? 

MR.  MORROW:     I'm  going  to  a  specific  thing 
that's  on  this  list  that's  discussed  in  the  chat  logs. 

THE  COURT:  Overruled. 
BY  MR.  MORROW: 

Q.  Mr.   Johnson,   I'm  showing  you  page  nine  of 

prosecution  exhibit  109  for  ID  and  beginning  with  the 
line  open  source  dot  gov,   can  you  read  just  everything 
under  there? 

A.  From  open  source  dot  gov.     We  have  brief,  the 
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complete  CIA  open  source  center  analytical  database .  The 
database  is  extensive,  unclassified,   non-p\ablic,  but 
relatively  accessible  to  certain  outsiders  after  jxamping 
through  hoops.     Despite  its  name,   you  need  to  be 
government  official  to  gain  access  to  it . 
Q .  Keep  going . 

A.  Entity.     Open  source  dot  gov,  and  it  provides 

a  long  URL  there,  sir. 

Q.  Okay.     Now  I'm  going  to  publish  prosecution 

exhibit  110.  And,  again,  I'm  going  to  show  page  nine  of 
that  exhibit .  And  if  you  could  read  the  open  source  dot 
gov  section  again,  please. 

A.  Open  source  dot  gov.     Brief,  the  complete  CIA 

open  source  center  analytical  database.     The  database  is 
extensive,  unclassified,   non-p\jblic,  but  relatively 
accessible  to  certain  outsiders  after  jumping  through 
hoops.     Despite  its  name,   you  need  to  be  government 
official  to  gain  access  to  it . 

Q.  Would  you  agree  that  the  last  two  exhibits 

that  that  basically  paragraph  is  basically  the  same? 

A.  Yes,  sir. 
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Q.  Almost  entirely  the  same? 

A.  I'd  have  to  look  at  them  side  by  side,  but  it 

appears  to  be  identical . 
Q .  Okay . 

THE  COURT:     I'm  going  to  stop  you  here  for 
just  a  moment.   Captain  Morrow.     Prosecution  exhibit  109 
for  identification  is  not  admitted  pending  the  motion 
that ' s  at  issue . 

MR.  MORROW:      I  agree.   Your  Honor. 

THE  COURT:     So  everything  that  you  went 
through  with  the  witness  on  an  unadmitted  docxoment, 
should  I  not  admit  it,   I'm  going  to  disregard  everything 
in  prosecution  exhibit  109  for  identification. 

MR.  MORROW:     I  understand.   Your  Honor. 
BY  MR.  MORROW: 

Q.  I'm  retrieving  prosecution  exhibit  123.  And 

Mr.   Johnson,   I'm  going  to  show  you  page  five  of  this 
exhibit . 

One  moment ,   Your  Honor . 

I ' m  sorry .     Took  me  a  second  to  find  it . 

Mr.   Johnson,   I'm  showing  you  the  top  of  page 
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five  of  prosecution  exhibit  123.     Can  you  read  that? 
A.  Yes,  sir. 

Q.  Okay.     I  want  to  start  from  basically  the 

second  line  down  where  it  says  yeah.     Can  you  read  down? 

A.  The  following  line,   are  you  referring  to  just 

the  message  text,  sir? 

Q.  Yeah.     Just  identify  the  party  who  is  saying 

it  and  then  identify  what's  being  said. 

A.  Yes,   sir.     The  next  line.     Pressassociation . 

Text  reading  WL  action  that  were  considered  totally 
radical  three  years  ago  are  now  courted. 

Next  line.     Dog  network.     I  told  you  before, 
government  organizations  can't  control  information.  The 
harder  they  try,   the  more  violently  the  information  wants 
to  get  out . 

The  following  line .     Pressassociation  saying 
to  2500  articles  in  dot  I  S  referendum  in  the  past  15 
hours,   despite  it  being  a  Sunday. 

Q.  Let  me  stop  you  there.     What  does  dot  I  S 

refer  to? 

A.  That  would  be  a  top  level  country  level 
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domain,  most,  likely. 


Q. 


Do  you  know  what  country? 


A. 


Not  offhand,   sir . 


Q. 


Okay.     Keep  going. 


A. 


Where  was  I?     Next  line.     Dog  network.  You 


apostrophe  like  the  first  pin  to  pop  a  balloon. 
Following  pressassoclatlon  saying  many  other  things  like 
this . 

Following  also,  pressassoclatlon,  restrict 
supply  equal  value  Increases,  yes. 

Next  line.     Dog  network.     Oh,   yeah.     OSC  went 
haywire  digging  Into  IS . 

Q.  Let  me  stop  you  there.     Do  you  know  what  OSC 

refers  to  In  these  chats? 

A.  Open  source  center. 

Q.  Okay.     Keep  going. 

A.  The  next  line,  pressassoclatlon,   stating  U.S. 

DOD  has  another  tact  though,   dxomp  billions  In  free, 
quote,   news,   quote,   content.     Next  line  also 
pressassoclatlon,  yes.     Or  yay.     Pardon  me.  Following 
line,   also  pressassoclatlon,  that  apostrophe,  something 
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we  want  to  mine  entirely,   B  T  W. 

Q.  Now,   when  pressassociation  says  that's 

something  we  want  to  mine  entirely  by  the  way,  what  are 
they  referring  to? 

A.  My  opinion  would  be  they  are  looking  to  — 

THE  COURT:     Sustained.  Speculation. 

Q.  Now,  what  does  pressassociation  say  below 

that ' s  something  we  want  to  mine  entirely  by  the  way? 

A.  That  line  it  reads,   I  have  an  account  there, 

but  changed  IPS  too  quickly. 

Q.  And  what  does  dog  network  say? 

A.  The  following  line,   usually  it's  pretty  dull 

reading,   one  or  two  things  a  day,  but  it's  like  25  for 
today  alone . 

Q.  Keep  going. 

A.  The  following  from  pressassociation.  Just 

FBIs  or  an  analysis  included. 

Following  dog  network.     No  analysis,  too 

early . 

Continuing,   dog  network.     24  to  48  hours  it 
takes  for  analysis,   if  done. 
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Q .  Let  me  stop  you  there .     What ' s  your 

understanding  of  what  open  source  center  is? 

A.  My  understanding  is  the  collection  by  the 

intelligence,   an  operation  of  the  intelligence  community 
that  collects  information  that  is  available  to  the 
outside  world,  not  classified,  but  it  is  pxiblicly 
available  though  maybe  not  directly  or  easily  find.  It 
would  include  things  such  as  news  sources,  various  pxiblic 
records,   databases  and  the  like. 

Q.  And  I  want  to  ask  you  one  more  thing.  When 

pressassociation  says  that ' s  something  you  want  to  mine 
entirely  by  the  way,   would  you  agree  that 
pressassociation ' s  expressed  — 

THE  COURT:     Let  him  ask  the  question.  One 

more  time . 

Q.  Would  you  agree  that  pressassociation  is 

expressing  some  interest  in  something?     It ' s  hard  to  say 
what  they're  referring  to,  but  — 

A.  I  think  that's  a  reasonable  interpretation, 

yes,  sir. 

Q.  Now,   Captain  Tooman  asked  you  earlier  whether 
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there  was  any  evidence  in  the  chats  that  pressassociation 
asked  PFC  Manning  to  give  them  anything.     And  you  said, 
no,  there's  no  evidence  of  that.     Do  you  still,  based  on 
your  reading  of  that,   something  you  want  to  mine  entirely 
by  the  way,   do  you  still  feel  that  way? 

A.  I  couldn't  say  with  any  degree  —  that  doesn't 

sound  like  a  direct  question  to  me,  but  it's  definitely 
something  of  interest . 

Q.  Okay.     Now,   Mr.   Johnson,    I  want  to  ask  you 

about  the  disk  utility  log.     Do  you  know  what  a  strongbox 
is? 

A.  Strongbox  in  this  situation  refers  to  an 

encrypted  file  we  found  on  Private  Manning ' s  computer . 

Q.  Now,   what  is  the  extension  for  a  strong  box? 

A.  It  was  DMG. 

Q.  So  what's  essentially  the  file,   what's  the 

file  name? 

A.  It  would  be  an  Apple  disk  image. 

Q.  And  you  said  it  was  encrypted? 

A.  Yes,  sir. 

Q.  Now,   were  you  able  to  open  this  strong  box? 
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A. 


No,  sir. 


Q. 


Do  you  recall  the  date  the  strong  box  was 


created? 


A. 


No,   sir.     I'd  have  to  refer. 


Q. 


I'm  retrieving  prosecution  exhibit  125. 


MR.  TOOMAN:     Ma'am,  may  I  object?  Relevance. 


THE  COURT:     Where  are  you  going  with  this? 


MR.  MORROW:     Your  Honor,  the  defense  asked 


several  questions  about  what  could  be  recovered  from  the 
computer .     I'm  simply  referring  to  a  file  that  the 
forensic  examiners  couldn ' t  open . 

THE  COURT:  Overruled. 
BY  MR.  MORROW: 

Q.  I'm  handing  you  the  disk  utility  log, 

prosecution  exhibit  125,   and  I'd  like  you  to  find  where 
in  the  disk  utility  log  this  strongbox  is. 

A.  Okay.     That  would  be  February  11,  2010. 

Q.  And  again,   you  said  you  could  not  open  this 


file? 


A. 


Yes,  sir. 


Q. 


Now,   when  a  file  is  encrypted,   are  you  able  to 
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tell  what ' s  inside  the  file? 


A.  No,  sir. 

Q.  So  you'd  have  no  idea  how  large  this  file  is? 

A.  No,   sir.     Not  at  that  time. 

Q.  Thank  you.     Handing  prosecution  exhibit  125 


back  to  the  court  reporter. 

Handing  123  back . 

One  last  question.     Were  you  able  to  tell, 
based  on  your  examination,  whether  files  were  being  added 
to  the  strongbox  throughout  the  course  of  PFC  Manning's? 

A.  I  cannot  tell  that  files  were  being  added  or 

removed.     However,   the  log  indicates  that  that  file  had 
been  expanded  several  times,  thus  the  reason  I  could  not 
determine  the  file  size  at  the  time  you  asked. 

Q.  But  you  wouldn't  be  able  to  tell  the  size  of 

the  files  in  there  anyway? 

A.  The  internal  contents? 

Q .  Yes . 

A.  No,  sir. 

Q.  I'm  sorry.     I  should  have  asked  this  when  I 

had  23  in  front  of  me,  but  in  your  opinion  were  the  chat 
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logs  with  pressassociation  complete? 
A.  I  could  not  tell,  sir. 

Q.  Were  there  days  missing  between  5  March  and  18 

March? 

A.  Yes,  sir. 

Q.  So  it  wasn't  5  March,   6  March,   7  March,  8 

March? 

A.  No.     There  were  some  missing  days,  sir. 

MR .  MORROW :     Thank  you .      I'm  handing 
prosecution  exhibit  109  for  identification  back  to  the 
court  reporter  and  prosecution  exhibit  110. 

THE  COURT:     Any  further  questions? 

MR.   TOOMAN:     No,  ma'am. 

THE  COURT:     I  just  have  a  couple. 

THE  WITNESS:     Yes,  ma'am. 

THE  COURT:     On  the  strongbox,   if  you  can't 
tell  how  big  a  file  is,   how  can  you  tell  if  it  gets 
bigger? 

THE  WITNESS:     What  we're  referring  to,  his 
question  was  the  contents  of  what  was  put  into  the 
strongbox.     The  strongbox  itself  is  the  container  file. 
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It ' s  sort  of  like  —  it  has  a  similar  function  to  RARs 
and  zip,  but  it's  an  Apple  specific  in  terms  of 
different,   it  serves  a  different  purpose.     So  I  can  tell 
the  file  size  of  the  DMG  itself,  but  not  what's  put 
inside.     Does  that  answer  your  question,  ma'am? 

THE  COURT:     Yes.     So  is  this  a  large  file  or 

a  small  file? 

THE  WITNESS:     It's  fairly  significant  size, 
sir,   or  ma'am. 

THE  COURT :     All  right .     Anything  based  on 
that  from  either  side? 

MR.  MORROW:     No,   Your  Honor. 

MR.   TOOMAN:     Just  briefly.   Your  Honor. 


RECROSS  EXAMINATION  BY  MR.  TOOMAN: 
Q.  Mr.   Johnson,   you  were  describing  the  strongbox 

getting  bigger.     Would  it  be  fair  to  say  the  strongbox  is 
kind  of  like  a  partition,   you're  like  fencing  off  an 
area? 

A.  No,   sir,   it's  not.     It's  closer  to  a  zip  or 
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RAR  type  file . 

Q.  Okay.     The  space  got  bigger? 

A.  Yes,  sir. 

Q.  And  you  don't  know  what  was  in  there? 

A.  No,  sir. 

Q.  Could  have  been  anything? 

A.  Could  be  anything. 

Q.  Could  be  pictures  of  PFC  Manning? 

A.  It  could  be  anything.     I  have  no  indication  of 

what ' s  in  there . 

Q.  Could  have  been  videos? 

A.  Possible. 

MR.   TOOMAN:     Okay.     Thank  you. 
THE  COURT:     Temporary  or  permanent  excusal? 
MR.  MORROW:     Temporary,   Your  Honor. 
THE  COURT:     Special  Agent  Johnson,  you're 
temporarily  excused.     Please  don't  discuss  your  testimony 
with  anyone  other  than  the  accused  or  counsel . 

THE  WITNESS:     Thank  you,  ma'am. 
THE  COURT:     Just  prior  to  reconvening  with 
this  witness  I  spoke  with  counsel  briefly  in  RCM  802 
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conference .     I  was  concerned  a  little  bit.  with  the 
defense  line  of  questioning  regarding  PFC  Manning  was 
charged  with  a  variety  of  different  things  and  that  there 
was  no  evidence  the  witness  had  in  his  report  that  shows 
a  transfer,  and  I  was  concerned  and  I  asked  Mr.  Coombs  if 
the  defense  was  challenging  the  transfers  other  than  the 
Farah  video  in  specification  11  of  charge  2  as  we've 
already  had  a  plea  that  established  those  elements . 

MR.   COOMBS:     Yes,   Your  Honor.     And  in 
response  to  that,  what  we  are  challenging  is  the  date  and 
time  period  which  the  government  has  charged  these 
releases,   not  that  PFC  Manning  did  them  or  not.     So  by 
pleading  by  exceptions  and  substitutions  we  pled  to 
certain  dates,  which  we  believe  the  forensic  evidence 
supports,   that  those  were  the  dates  in  which  PFC  Manning 
gave  the  information.     Unlike  what  the  government  has 
charged  in  the  charge  sheet  which  is  a  much  broader  date 
range . 

THE  COURT :     All  right .     Thank  you . 
Now,   looking  at  the  time,   is  this  a  good  time 
to  have  a  lunch  break? 
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MR.   FEIN:     Yes,   ma'am,    it  is. 
THE  COURT:     How  long  would  we  like  here? 
1330  work  for  both  sides? 
MR.   FEIN:     It  does,  ma'am. 
THE  COURT:     All  right.  1330. 
(LUNCH  RECESS.) 
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